CVE-2016-4432 AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication
CriticalCVSS 9.1
EPSS 8.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol(Maven) | < 6.0.3 | 6.0.3 |
| org.apache.qpid/qpid-broker-plugins-amqp-1-0-protocol(Maven) | < 6.0.3 | 6.0.3 |
| org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol(Maven) | = 0.24 | No fix listed |
| org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol(Maven) | = 0.26 | No fix listed |
| org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol(Maven) | = 0.28 | No fix listed |
| org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol(Maven) | = 0.30 | No fix listed |
| org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol(Maven) | = 0.32 | No fix listed |
| org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol(Maven) | = 6.0.0 | No fix listed |
| org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol(Maven) | = 6.0.1 | No fix listed |
| org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol(Maven) | = 6.0.2 | No fix listed |
| org.apache.qpid/qpid-broker-plugins-amqp-1-0-protocol(Maven) | = 0.24 | No fix listed |
| org.apache.qpid/qpid-broker-plugins-amqp-1-0-protocol(Maven) | = 0.26 | No fix listed |
| org.apache.qpid/qpid-broker-plugins-amqp-1-0-protocol(Maven) | = 0.28 | No fix listed |
| org.apache.qpid/qpid-broker-plugins-amqp-1-0-protocol(Maven) | = 0.30 | No fix listed |
| org.apache.qpid/qpid-broker-plugins-amqp-1-0-protocol(Maven) | = 0.32 | No fix listed |
| org.apache.qpid/qpid-broker-plugins-amqp-1-0-protocol(Maven) | = 6.0.0 | No fix listed |
| org.apache.qpid/qpid-broker-plugins-amqp-1-0-protocol(Maven) | = 6.0.1 | No fix listed |
| org.apache.qpid/qpid-broker-plugins-amqp-1-0-protocol(Maven) | = 6.0.2 | No fix listed |
| apache qpid broker-j | < 6.0.3 | 6.0.3 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- issues.apache.org issue-tracking vendor-advisory
- svn.apache.org patch vendor-advisory
- svn.apache.org patch vendor-advisory
- [qpid-users] 20160527 [CVE-2016-4432] Apache Qpid Java Broker - authentication bypass mailing-list vendor-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- github.com
- github.com product
- 20160527 [CVE-2016-4432] Apache Qpid Java Broker - authentication bypass mailing-list third-party-advisory vdb-entry
- 1035983 broken-link third-party-advisory vdb-entry