CVE-2016-8741
Summary
| CVE | CVE-2016-8741 |
|---|---|
| State | PUBLISHED |
| Assigner | apache |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-05-15 14:29:00 UTC |
| Updated | 2025-04-20 01:37:25 UTC |
| Description | The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for Java 6.0.x before 6.0.6 and 6.1.x before 6.1.1 prematurely terminate the SCRAM SASL negotiation if the provided user name does not exist thus allowing remote attacker to determine the existence of user accounts. The Vulnerability does not apply to AuthenticationProviders other than SCRAM-SHA-1 and SCRAM-SHA-256. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-200 | Information Leakage
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 2.0 | [email protected] | Primary | 5 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:L/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Qpid Broker-j | 6.0.1 | All | All | All |
| Application | Apache | Qpid Broker-j | 6.0.2 | All | All | All |
| Application | Apache | Qpid Broker-j | 6.0.3 | All | All | All |
| Application | Apache | Qpid Broker-j | 6.0.4 | All | All | All |
| Application | Apache | Qpid Broker-j | 6.0.5 | All | All | All |
| Application | Apache | Qpid Broker-j | 6.1.0 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Apache Software Foundation | Apache Qpid Broker-J | affected 6.0.1, 6.0.2, 6.0.3, 6.0.4, and 6.0.5 | Not specified |
| CNA | Apache Software Foundation | Apache Qpid Broker-J | affected 6.1.0 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [QPID-7599] [CVE-2016-8741] Prevent leaking information about the existence of user accounts in SCRAM-SHA256/SCRAM-SHA1 authentication providers - ASF JIRA | af854a3a-2127-422b-91ae-364da2661108 | issues.apache.org | Issue Tracking |
| Apache Qpid Broker for Java Certain AuthenticationProviders Let Remote Users Determine Valid Usernames on the Target System - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | Broken Link, Third Party Advisory, VDB Entry |
| Apache Qpid users - [CVE-2016-8741] Apache Qpid Broker for Java - Information Leakage | af854a3a-2127-422b-91ae-364da2661108 | qpid.2158936.n2.nabble.com | Vendor Advisory |
| Apache Qpid Broker for Java CVE-2016-8741 Remote Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Broken Link, Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.