https://bugzilla.redhat.com/show_bug.cgi?id=1880101
--- Doc Text *updated* by Eric Christensen <sparks(a)redhat.com> ---
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and
binds the server to the "jmxrmi" entry. It is possible to connect to the
registry without authentication and call the rebind method to rebind jmxrmi to something
else. If an attacker creates another server to proxy the original, and bound that, he
effectively becomes a man in the middle and is able to intercept the credentials when an
user connects.
--
You are receiving this mail because:
You are on the CC list for the bug.