[QPID-7599] [CVE-2016-8741] Prevent leaking information about the existence of user accounts in SCRAM-SHA256/SCRAM-SHA1 authentication providers

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: qpid-java-6.0.1, qpid-java-6.0.2, qpid-java-6.0.3, qpid-java-6.0.4, qpid-java-6.0.5, qpid-java-6.1
• Fix Version/s: qpid-java-6.0.6, qpid-java-6.1.1
• Component/s: Broker-J
• Assignee: Unassigned
• Reporter: Alex Rudyy
• Created: 28/Dec/16 11:19
• Updated: 29/Dec/16 09:29
• Resolved: 28/Dec/16 11:38

Description

SCRAM-SHA256 and SCRAM-SHA1 authentication providers prematurely terminate the SCRAM SASL negotiation if the provided user name does not exist thus allowing remote attacker to determine the existence of user accounts.

CVE-2016-8741 was raised for this issue.