VulnerabilityModified

CVE-2016-8741

It was discovered that these AuthenticationProviders in Apache Qpid Broker for Java 6.0.x before 6.0.6 and 6.1.x before 6.1.1 prematurely terminate the SCRAM SASL negotiation if the provided user name does not exist thus allowing remote attacker to…

HIGH 7.5EPSS 6.30%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (6.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for Java 6.0.x before 6.0.6 and 6.1.x before 6.1.1 prematurely terminate the SCRAM SASL negotiation if the provided user name does not exist thus allowing remote attacker to determine the existence of user accounts. The Vulnerability does not apply to AuthenticationProviders other than SCRAM-SHA-1 and SCRAM-SHA-256.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 6.30% probability · 93th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: apache/qpid broker-j
Source: security@apache.org

References

http://qpid.2158936.n2.nabble.com/CVE-2016-8741-Apache-Qpid-Broker-for-Java-Information-Leakage-td7657025.htmlVendor Advisory
http://www.securityfocus.com/bid/95136Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037537Broken Link, Third Party Advisory, VDB Entry
https://issues.apache.org/jira/browse/QPID-7599Issue Tracking
http://qpid.2158936.n2.nabble.com/CVE-2016-8741-Apache-Qpid-Broker-for-Java-Information-Leakage-td7657025.htmlVendor Advisory
http://www.securityfocus.com/bid/95136Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037537Broken Link, Third Party Advisory, VDB Entry
https://issues.apache.org/jira/browse/QPID-7599Issue Tracking

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.