PT-2012-1003 · Apache · Apache Qpid
Paul Colby
·
Publicado
2012-06-22
·
Atualizado
2022-05-17
·
CVE-2012-3467
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Apache QPID versions 0.14, 0.16, and earlier
Description
The issue is related to an error in the authentication mechanism when handling AMQP client shadow connections, allowing remote attackers to bypass authentication. This could potentially enable an attacker to impersonate a legitimate user by sending a specially crafted request.
Recommendations
For Apache QPID versions 0.14, 0.16, and earlier, consider disabling the NullAuthenticator mechanism as a temporary workaround until a patch is available.
Restrict access to the AMQP broker to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Qpid