Authentication Bypass in Apache QPID by NullAuthenticator Mechanism
CVE-2012-3467

Currently unrated

Key Information:

Vendor
Apache
Status
Qpid
Vendor
CVE Published:
27 August 2012

Summary

The Apache QPID messaging framework contains a vulnerability in which the NullAuthenticator mechanism can be exploited to bypass authentication for catch-up shadow connections to AMQP brokers. This flaw allows remote attackers to gain unauthorized access to the broker, potentially compromising sensitive data and disrupting service.

References

http://svn.apache.org/viewvc?view=revision&revision=1352992
x_refsource_CONFIRM
http://secunia.com/advisories/50186
third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/54954
vdb-entryx_refsource_BID

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.