CVE-2012-4446: Medium severity Apache qpid vulnerability

Florian Weimer of the Red Hat Product Security Team discovered that setting the federationtag attribute in an AMQP connection would turn the connection into a broker-to-broker connection, rather than a client-to-server connection. Because of this, incoming user IDs are not checked, so if a client were to set the federationtag attribute when establishing a regular AMQP connection, Qpid would no longer check the user ID on AMQP messages submitted by the client. The client can then supply any value and thus impersonate any user, since AMQP messages carry user information that identify the sender and message recipients, which use user names for authentication purposes. The client does have to authenticate, but any authentication method, including SASL ANONYMOUS would work.