Vulnerability Name:

CVE-2019-18609 (CCN-172448)

Assigned:2019-10-29
Published:2019-10-29
Updated:2022-01-01
Summary:An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server could return a malicious frame header that leads to a smaller target_size value than needed. This condition is then carried on to a memcpy function that copies too much data into a heap buffer.
CVSS v3 Severity:9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
8.6 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
7.5 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): High
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-787
CWE-122
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2019-18609

Source: XF
Type: UNKNOWN
rabbitmqc-cve201918609-dos(172448)

Source: MISC
Type: Third Party Advisory
https://github.com/alanxz/rabbitmq-c/blob/master/ChangeLog.md

Source: CCN
Type: rabbitmq-c GIT Repository
lib: check frame_size is >= INT32_MAX

Source: CONFIRM
Type: Patch, Third Party Advisory
https://github.com/alanxz/rabbitmq-c/commit/fc85be7123050b91b054e45b91c78d3241a5047a

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20191206 [SECURITY] [DLA 2022-1] librabbitmq security update

Source: FEDORA
Type: Third Party Advisory
FEDORA-2019-dd7c8f5435

Source: FEDORA
Type: Third Party Advisory
FEDORA-2019-8730b65158

Source: MISC
Type: Issue Tracking, Third Party Advisory
https://news.ycombinator.com/item?id=21681976

Source: GENTOO
Type: Third Party Advisory
GLSA-202003-07

Source: UBUNTU
Type: Third Party Advisory
USN-4214-1

Source: UBUNTU
Type: Third Party Advisory
USN-4214-2

Vulnerable Configuration:Configuration 1:
  • cpe:/a:rabbitmq-c_project:rabbitmq-c:*:*:*:*:*:*:*:* (Version < 0.10.0)

    • Configuration 2:
  • cpe:/o:fedoraproject:fedora:30:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:31:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:7::computenode:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/a:redhat:enterprise_linux:8::crb:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:8::baseos:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:3494
    P
    		gd-2.1.0-24.12.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:95124
    P
    		librabbitmq-devel-0.10.0-3.19 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:112797
    P
    		librabbitmq-devel-0.11.0-2.3 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106268
    P
    		Security update for glib-networking (Important)
    2021-12-10
    oval:org.opensuse.security:def:2256
    P
    		librabbitmq-devel-0.10.0-3.19 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63345
    P
    		librabbitmq-devel-0.10.0-3.19 on GA media (Moderate)
    2021-08-10
    oval:com.redhat.rhsa:def:20204445
    P
    		RHSA-2020:4445: librabbitmq security update (Moderate)
    2020-11-04
    oval:com.redhat.rhsa:def:20203949
    P
    		RHSA-2020:3949: librabbitmq security update (Moderate)
    2020-09-29
    oval:com.ubuntu.disco:def:2019186090000000
    V
    		CVE-2019-18609 on Ubuntu 19.04 (disco) - medium.
    2019-12-02
    oval:com.ubuntu.bionic:def:2019186090000000
    V
    		CVE-2019-18609 on Ubuntu 18.04 LTS (bionic) - medium.
    2019-12-02
    oval:com.ubuntu.xenial:def:2019186090000000
    V
    		CVE-2019-18609 on Ubuntu 16.04 LTS (xenial) - medium.
    2019-12-02
    BACK
    rabbitmq-c_project rabbitmq-c *
    fedoraproject fedora 30
    fedoraproject fedora 31
    canonical ubuntu linux 14.04
    canonical ubuntu linux 16.04
    canonical ubuntu linux 18.04
    canonical ubuntu linux 19.04
    canonical ubuntu linux 19.10
    debian debian linux 8.0