Vulnerability CVE-2016-9877 - CERT Civis.Net

Vulnerability Name:

CVE-2016-9877 (CCN-120242)

Assigned:

2016-12-29

Published:

2016-12-29

Updated:

2022-03-17

Summary:

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.

CVSS v3 Severity:

9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2016-9877

Source: DEBIAN
Type: UNKNOWN
DSA-3761

Source: CCN
Type: IBM Security Bulletin T1025244 (PowerKVM)
Vulnerabilities in rabbitmq-server affect PowerKVM

Source: BID
Type: UNKNOWN
95065

Source: CCN
Type: BID-95065
Pivotal RabbitMQ Products CVE-2016-9877 Authentication Bypass Vulnerability

Source: XF
Type: UNKNOWN
pivotal-rabbitmq-cve20169877-sec-bypass(120242)

Source: CCN
Type: Pivotal Web site
CVE-2016-9877 RabbitMQ authentication vulnerability

Source: CONFIRM
Type: Mitigation, Vendor Advisory
https://pivotal.io/security/cve-2016-9877

Source: CONFIRM
Type: UNKNOWN
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03880en_us

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2016-9877

Vulnerable Configuration:

Configuration 1:

cpe:/a:vmware:rabbitmq:3.5.2:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.5.3:*:*:*:*:*:*:*

OR cpe:/a:pivotal_software:rabbitmq:3.5.4:-:*:*:*:*:*:*

OR cpe:/a:pivotal_software:rabbitmq:3.6.3:-:*:*:*:*:*:*

OR cpe:/a:pivotal_software:rabbitmq:3.6.4:-:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.1.0:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.1.1:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.2.2:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.2.3:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.2.4:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.4.0:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.4.1:*:*:*:*:*:*:*

OR cpe:/a:pivotal_software:rabbitmq:3.5.5:-:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.5.6:*:*:*:*:*:*:*

OR cpe:/a:pivotal_software:rabbitmq:3.6.5:-:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.0.0:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.1.2:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.1.3:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.3.0:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.3.1:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.4.2:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.4.3:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.5.0:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.5.1:*:*:*:*:*:*:*

OR cpe:/a:pivotal_software:rabbitmq:3.6.1:-:*:*:*:*:*:*

OR cpe:/a:pivotal_software:rabbitmq:3.6.2:-:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.0.3:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.0.4:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.2.0:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.2.1:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.3.4:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.3.5:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.4.4:*:*:*:*:*:*:*

OR cpe:/a:pivotal_software:rabbitmq:3.5.7:-:*:*:*:*:*:*

OR cpe:/a:pivotal_software:rabbitmq:3.6.0:-:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.0.2:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.1.4:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.1.5:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.3.2:*:*:*:*:*:*:*

OR cpe:/a:vmware:rabbitmq:3.3.3:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:pivotal_software:rabbitmq:1.5.13:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.5.11:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.5.10:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.5.3:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.5.2:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.6.4:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.6.3:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.7.3:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.7.2:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.5.18:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.5.17:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.5.9:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.5.8:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.5.1:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.6.10:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.6.9:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.6.2:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.6.1:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.7.0:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.5.0:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.5.12:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.5.5:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.5.4:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.6.6:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.6.5:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.7.5:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.7.4:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.5.15:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.5.14:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.5.7:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.5.6:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.6.8:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.6.7:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.6.0:*:*:*:*:pivotal_cloud_foundry:*:*

OR cpe:/a:pivotal_software:rabbitmq:1.7.6:*:*:*:*:pivotal_cloud_foundry:*:*

Configuration CCN 1:

cpe:/a:ibm:powerkvm:3.1:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20169877	V	CVE-2016-9877	2022-09-02
oval:org.opensuse.security:def:3475	P	dovecot22-2.2.31-19.17.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:95105	P	erlang-rabbitmq-client-3.8.11-3.3.3 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:112198	P	erlang-rabbitmq-client-3.9.7-1.1 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:94203	P	(Important)	2021-12-06
oval:org.opensuse.security:def:105729	P	erlang-rabbitmq-client-3.9.7-1.1 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:63326	P	erlang-rabbitmq-client-3.8.11-1.26 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2237	P	erlang-rabbitmq-client-3.8.11-1.26 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:100916	P	libidn2-0-2.2.0-3.6.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:66872	P	Security update for libvirt (Moderate)	2021-07-27
oval:org.opensuse.security:def:1616	P	Security update for apache2 (Important)	2021-06-22
oval:org.opensuse.security:def:70228	P	Security update for avahi (Important)	2021-06-03
oval:org.opensuse.security:def:66780	P	Security update for djvulibre (Important)	2021-05-19
oval:org.opensuse.security:def:73445	P	Security update for perl-Convert-ASN1 (Moderate)	2021-01-21
oval:org.opensuse.security:def:2172	P	erlang-rabbitmq-client-3.8.3-1.27 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:73563	P	Security update for xen (Important)	2020-12-03
oval:org.opensuse.security:def:117140	P	erlang-rabbitmq-client-3.8.3-1.27 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63261	P	erlang-rabbitmq-client-3.8.3-1.27 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:107582	P	erlang-rabbitmq-client-3.8.3-1.27 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:50003	P	gtk-vnc-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50057	P	erlang-rabbitmq-client on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:70123	P	libvdpau-devel on GA media (Moderate)	2020-12-01
oval:org.cisecurity:def:1762	P	DSA-3761-1 -- rabbitmq-server -- security update	2017-02-24
oval:com.ubuntu.precise:def:20169877000	V	CVE-2016-9877 on Ubuntu 12.04 LTS (precise) - medium.	2016-12-29
oval:com.ubuntu.trusty:def:20169877000	V	CVE-2016-9877 on Ubuntu 14.04 LTS (trusty) - high.	2016-12-29
oval:com.ubuntu.xenial:def:201698770000000	V	CVE-2016-9877 on Ubuntu 16.04 LTS (xenial) - high.	2016-12-29
oval:com.ubuntu.xenial:def:20169877000	V	CVE-2016-9877 on Ubuntu 16.04 LTS (xenial) - high.	2016-12-29