PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.
References
| Link | Resource |
|---|---|
| http://mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3C5748641A.2050701%40gmail.com%3E | Vendor Advisory |
| http://packetstormsecurity.com/files/137215/Apache-Qpid-Java-Broker-6.0.2-Denial-Of-Service.html | Third Party Advisory VDB Entry |
| http://qpid.apache.org/releases/qpid-java-6.0.3/release-notes.html | Release Notes |
| http://www.securityfocus.com/archive/1/538507/100/0/threaded | Third Party Advisory VDB Entry |
| http://www.securitytracker.com/id/1035982 | Third Party Advisory VDB Entry |
| https://issues.apache.org/jira/browse/QPID-7271 | Vendor Advisory |
| https://svn.apache.org/viewvc?view=revision&revision=1744403 | Release Notes |
Configurations
History
22 May 2023, 15:46
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache qpid Broker-j
|
|
| CPE | cpe:2.3:a:apache:qpid_broker-j:*:*:*:*:*:*:*:* | |
| References | (CONFIRM) https://svn.apache.org/viewvc?view=revision&revision=1744403 - Release Notes | |
| References | (CONFIRM) http://qpid.apache.org/releases/qpid-java-6.0.3/release-notes.html - Release Notes | |
| References | (BUGTRAQ) http://www.securityfocus.com/archive/1/538507/100/0/threaded - Third Party Advisory, VDB Entry | |
| References | (MISC) http://packetstormsecurity.com/files/137215/Apache-Qpid-Java-Broker-6.0.2-Denial-Of-Service.html - Third Party Advisory, VDB Entry | |
| References | (SECTRACK) http://www.securitytracker.com/id/1035982 - Third Party Advisory, VDB Entry |
Information
Published : 2016-06-01 20:59
Updated : 2023-12-10 11:46
NVD link : CVE-2016-3094
Mitre link : CVE-2016-3094
CVE.ORG link : CVE-2016-3094
JSON object : View
Products Affected
apache
- qpid_broker-j