PT-2016-7860 · Pivotal+4 · Rabbitmq+3

Published 2016-12-29 · Updated 2025-04-02 · CVE-2016-9877

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pivotal RabbitMQ versions 3.x through 3.5.7 Pivotal RabbitMQ versions 3.6.x through 3.6.5 RabbitMQ for PCF versions 1.5.x through 1.5.19 RabbitMQ for PCF versions 1.6.x through 1.6.11 RabbitMQ for PCF versions 1.7.x through 1.7.6

Description An issue was discovered where MQTT connection authentication with a username/password pair succeeds even if the password is omitted from the connection request, provided an existing username is given. This issue does not affect connections that use TLS with a client-provided certificate.

Recommendations For Pivotal RabbitMQ versions 3.x through 3.5.7, update to version 3.5.8 or later. For Pivotal RabbitMQ versions 3.6.x through 3.6.5, update to version 3.6.6 or later. For RabbitMQ for PCF versions 1.5.x through 1.5.19, update to version 1.5.20 or later. For RabbitMQ for PCF versions 1.6.x through 1.6.11, update to version 1.6.12 or later. For RabbitMQ for PCF versions 1.7.x through 1.7.6, update to version 1.7.7 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2017-1311

ALT-PU-2017-2710

CVE-2016-9877

DSA-3761-1

OPENSUSE-SU-2017_0306-1

OPENSUSE-SU-2024:11294-1

USN-3374-1

Affected Products

Alt Linux

Rabbitmq

Suse

Ubuntu

References · 28

• https://security-tracker.debian.org/tracker/source-package/rabbitmq-server · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-9877 · Vendor Advisory
• http://debian.org/security/2017/dsa-3761 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3374-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9877 · Vendor Advisory
• https://pivotal.io/security/cve-2016-9877 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9877 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9877 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9877 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-2710 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-1311 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9877 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3761-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-9877 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-9877 · Security Note