CVE-2016-4432

EUVD-2018-0658
The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 59%
Affected Products (NVD)
VendorProductVersion
apacheqpid_broker-j
𝑥
< 6.0.3
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
qpid-cpp
artful
ignored
bionic
dne
cosmic
dne
precise
ignored
trusty
dne
wily
ignored
xenial
ignored
yakkety
ignored
zesty
ignored
Common Weakness Enumeration
References
http://mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3CCAFEMS4tXDKYxKVMmU0zTb_7uzduoUS4_RePnUwz1tj%2BGQLNw5Q%40mail.gmail.com%3E
http://packetstormsecurity.com/files/137216/Apache-Qpid-Java-Broker-6.0.2-Authentication-Bypass.html
http://www.securityfocus.com/archive/1/538508/100/0/threaded
http://www.securitytracker.com/id/1035983
https://issues.apache.org/jira/browse/QPID-7257
https://svn.apache.org/viewvc?view=revision&revision=1743161
https://svn.apache.org/viewvc?view=revision&revision=1743393
http://mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3CCAFEMS4tXDKYxKVMmU0zTb_7uzduoUS4_RePnUwz1tj%2BGQLNw5Q%40mail.gmail.com%3E
http://packetstormsecurity.com/files/137216/Apache-Qpid-Java-Broker-6.0.2-Authentication-Bypass.html
http://www.securityfocus.com/archive/1/538508/100/0/threaded
http://www.securitytracker.com/id/1035983
https://issues.apache.org/jira/browse/QPID-7257
https://svn.apache.org/viewvc?view=revision&revision=1743161
https://svn.apache.org/viewvc?view=revision&revision=1743393