oss-security - [SECURITY] [CVE-2018-8030] Apache Qpid Broker-J Denial of Service Vulnerability when AMQP 0-8...0-91 messages exceed maximum size limit

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAP3WMuQfUAc9pP95Et_aQN5ko+6EYe4nYD7zwNXp8+5KPsz8XQ@mail.gmail.com>
Date: Mon, 18 Jun 2018 21:45:21 +0100
From: Alex Rudyy <orudyy@...che.org>
To: "users@...d.apache.org" <users@...d.apache.org>, "dev@...d.apache.org" <dev@...d.apache.org>, 
	Apache Security Team <security@...che.org>, oss-security@...ts.openwall.com, announce@...che.org
Subject: [SECURITY] [CVE-2018-8030] Apache Qpid Broker-J Denial of Service
 Vulnerability when AMQP 0-8...0-91 messages exceed maximum size limit

CVE-2018-8030: Apache Qpid Broker-J Denial of Service Vulnerability
when AMQP 0-8...0-91 messages exceed maximum size limit

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: Versions 7.0.0-7.0.4

Description:

A Denial of Service vulnerability [1] was found in Apache Qpid Broker-J
versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to
publish messages with size greater than allowed maximum message size limit
(100MB by default). The broker crashes due to the defect. AMQP protocols
0-10 and 1.0 are not affected.

Resolution:

Users of Broker-J versions 7.0.0-7.0.4 utilizing AMQP protocols 0-8, 0-9 or 0-91
for message publishing must upgrade to version 7.0.5 [2] or later.

Mitigation:

If upgrade of the broker is not possible, the maximum message size limit can be
disabled by setting context variable "qpid.max_message_size" to "0" or
any negative value. The change can be made either directly in the broker
configuration file, or by using management interfaces (for example,
REST API [3])
or by using JVM option -Dqpid.max_message_size=0. A broker restart is required
for the change to take effect.
Alternatively, the support for AMQP protocols 0-8...0-91 can be removed on
AMQP ports. The change can be made either directly in the broker configuration
file or by using management interfaces. An example of REST API call
restricting AMQP port to support only AMQP 1.0 and AMQP 0-10 using curl utility
is provided below:

curl --user <user-name> -X POST  -d '{"protocols":["AMQP_1_0","AMQP_0_10"]}' \
https://<broker host>:<broker port>/api/latest/port/<port name>

Credit: This issue was found by the Qpid development team.

References:

[1] https://issues.apache.org/jira/browse/QPID-8203
[2] https://qpid.apache.org/releases/qpid-broker-j-7.0.5/index.html
[3] https://qpid.apache.org/releases/qpid-broker-j-7.0.5/book/Java-Broker-Management-Channel-REST-API.html

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.