CVE-2016-3094

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20 CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3C5748641A.2050701%40gmail.com%3EVendor Advisory
http://packetstormsecurity.com/files/137215/Apache-Qpid-Java-Broker-6.0.2-Denial-Of-Service.htmlThird Party Advisory, VDB Entry
http://qpid.apache.org/releases/qpid-java-6.0.3/release-notes.htmlRelease Notes
http://www.securityfocus.com/archive/1/538507/100/0/threadedThird Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035982Third Party Advisory, VDB Entry
https://issues.apache.org/jira/browse/QPID-7271Vendor Advisory
https://svn.apache.org/viewvc?view=revision&revision=1744403Release Notes
http://mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3C5748641A.2050701%40gmail.com%3EVendor Advisory
http://packetstormsecurity.com/files/137215/Apache-Qpid-Java-Broker-6.0.2-Denial-Of-Service.htmlThird Party Advisory, VDB Entry
http://qpid.apache.org/releases/qpid-java-6.0.3/release-notes.htmlRelease Notes
http://www.securityfocus.com/archive/1/538507/100/0/threadedThird Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035982Third Party Advisory, VDB Entry
https://issues.apache.org/jira/browse/QPID-7271Vendor Advisory
https://svn.apache.org/viewvc?view=revision&revision=1744403Release Notes

Timeline

Published: Jun 1, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-30955.5server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.CVE-2016-30967.8The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbit CVE-2016-30976.1Cross-site scripting (XSS) vulnerability in spacewalk-java in Red Hat Satellite 5.7 allows remote attackers to inject arbitrary web script o CVE-2016-30985.4Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autoriz CVE-2016-30997.5mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise CVE-2016-31008.4kinit in KDE Frameworks before 5.23.0 uses weak permissions (644) for /tmp/xauth-xxx-_y, which allows local users to obtain X11 cookies of o CVE-2016-31015.4Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web CVE-2016-31027.3The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugi CVE-2016-31047.5mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service (memory consumption and proce CVE-2016-31058.8The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository CVE-2016-31065.3Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner.CVE-2016-31075.5The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" dir