CVE-2016-4432
published 2016-06-01CVE-2016-4432: The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently…
PriorityP262critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
8.15%
94.2th percentile
The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | qpid_broker-j | < 6.0.3 | 6.0.3 |
Detection & IOCsextracted from sources · hover to see the quote
- →Authentication bypass affects AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3; monitor for unauthenticated or anomalous connections on AMQP ports using these protocol versions ↗
- →Watch for unauthorized message injection or message theft on AMQP broker instances running Apache Qpid Java < 6.0.3, as exploitation allows injecting or stealing messages without valid credentials ↗
- →The vulnerability is not exploitable if the ACL feature is enabled AND access to all virtual hosts is controlled; absence of 'ACCESS VIRTUALHOST' ACL clauses is an indicator of a vulnerable configuration ↗
- ·Mitigation (if upgrade is not possible): add 'ACCESS VIRTUALHOST' clauses to the ACL file to whitelist user access to all virtualhosts ↗
- ·Mitigation: if AMQP 0-8, 0-9, 0-91, and 0-10 are not required, disable these protocols at the Port level to eliminate the attack surface ↗
- ·Red Hat MRG 2/3 and Satellite 6 deployments of qpid-java are not affected because they use client certificate authentication rather than qpid-java's internal authentication system ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv9.1CRITICAL
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication
osv·2018-10-16
CVE-2016-4432 [CRITICAL] AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication
AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication
The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.
GHSA
AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication
ghsa·2018-10-16
CVE-2016-4432 [CRITICAL] CWE-287 AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication
AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication
The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.
OSV
CVE-2016-4432: The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6
osv·2016-06-01·CVSS 9.1
CVE-2016-4432 [CRITICAL] CVE-2016-4432: The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6
The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.
Red Hat
qpid-java: Authentication bypass
vendor_redhat·2016-05-27·CVSS 9.1
CVE-2016-4432 [CRITICAL] CWE-287 qpid-java: Authentication bypass
qpid-java: Authentication bypass
The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.
Statement: This issue did not affect the versions of the qpid -java broker as shipped with Red Hat MRG 2 and 3 and Satellite 6 as they did not use the access feature (e.g. Satellite 6 relies on client certificate authentication to control access).
Mitigation: If upgrading is not possible, the vulnerability can be mitigated using
an ACL file containing "ACCESS VIRTUALHOST" clauses that white-lists
user access to all virtualhosts.
If AMQP 0-8, 0-9, 0-91, and 0-10 support is not required, the
vulnerability can also be mitigated by turning
No detection rules found.
No public exploits indexed.
http://mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3CCAFEMS4tXDKYxKVMmU0zTb_7uzduoUS4_RePnUwz1tj%2BGQLNw5Q%40mail.gmail.com%3Ehttp://packetstormsecurity.com/files/137216/Apache-Qpid-Java-Broker-6.0.2-Authentication-Bypass.htmlhttp://www.securityfocus.com/archive/1/538508/100/0/threadedhttp://www.securitytracker.com/id/1035983https://issues.apache.org/jira/browse/QPID-7257https://svn.apache.org/viewvc?view=revision&revision=1743161https://svn.apache.org/viewvc?view=revision&revision=1743393http://mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3CCAFEMS4tXDKYxKVMmU0zTb_7uzduoUS4_RePnUwz1tj%2BGQLNw5Q%40mail.gmail.com%3Ehttp://packetstormsecurity.com/files/137216/Apache-Qpid-Java-Broker-6.0.2-Authentication-Bypass.htmlhttp://www.securityfocus.com/archive/1/538508/100/0/threadedhttp://www.securitytracker.com/id/1035983https://issues.apache.org/jira/browse/QPID-7257https://svn.apache.org/viewvc?view=revision&revision=1743161https://svn.apache.org/viewvc?view=revision&revision=1743393
2016-06-01
Published