Vulnerabilities > CVE-2019-0222

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
apache
netapp
oracle
debian
nessus
NVD
Published: 2019-03-28
Updated: 2024-11-21

Summary

In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.

Vulnerable Configurations

Part Description Count
Application
Apache
49
Application
Netapp
1
Application
Oracle
10
OS
Debian
1

Nessus

  • NASL familyMisc.
    NASL idORACLE_ENTERPRISE_MANAGER_JUL_2019_CPU.NASL
    descriptionThe version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by multiple vulnerabilities in Enterprise Manager Base Platform component: - An unspecified vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Products Suite (subcomponent: Connector Framework (Apache CXF)), which could allow an unauthenticated, remote attacker to compromise Enterprise Manager Base Platform. (CVE-2018-8039) - An unspecified vulnerability in the Oracle Enterprise Manager Base Platform component of Oracle Enterprise Manager Products Suite (subcomponent: Valid Session (Apache ActiveMQ)), which could allow an unauthenticated, remote attacker to compromise Oracle Enterprise Manager Base Platform. (CVE-2019-0222) - An unspecified vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Products Suite (subcomponent: Discovery Framework (OpenSSL)), which could allow and unauthenticated, remote attacker to compromise Enterprise Manager Base Platform. (CVE-2019-1559)
    last seen2020-06-01
    modified2020-06-02
    plugin id126775
    published2019-07-17
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126775
    titleOracle Enterprise Manager Cloud Control (Jul 2019 CPU)
  • NASL familyCGI abuses
    NASL idACTIVEMQ_5_15_9.NASL
    descriptionThe version of Apache ActiveMQ running on the remote host is 5.x prior to 5.15.9. It is, therefore, affected by a denial of service (DoS) vulnerability due to improper validation of MQTT frames. An unauthenticated, remote attacker can exploit this issue to cause the broker to stop responding.
    last seen2020-06-01
    modified2020-06-02
    plugin id123756
    published2019-04-05
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/123756
    titleApache ActiveMQ 5.x < 5.15.9 Corrupt MQTT Frame Denial of Service (DoS) (CVE-2019-0222)
  • NASL familyMisc.
    NASL idORACLE_IDENTITY_MANAGEMENT_CPU_APR_2020.NASL
    descriptionThe remote host is missing the April 2020 Critical Patch Update for Oracle Identity Manager Connector. It is, therefore, affected by multiple vulnerabilities: - Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: General (Apache ActiveMQ)). The supported version that is affected is 9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Identity Manager Connector. (CVE-2019-0222) - Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway (Spring Framework)). The supported version that is affected is 9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Identity Manager Connector. (CVE-2018-15756) Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-05-06
    modified2020-05-01
    plugin id136284
    published2020-05-01
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136284
    titleOracle Identity Manager Connector Multiple Vulnerabilities (April 2020 CPU)

References