oss-security - [SECURITY] CVE-2019-0200: Apache Qpid Broker-J Denial of Service due to malformed AMQP 0-8 to 0-10 commands

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAP3WMuR-CCdbACWo7QVPTJ04+twGLGzg4SVBakUDD+NkNTKoog@mail.gmail.com>
Date: Fri, 1 Mar 2019 17:22:14 +0000
From: Alex Rudyy <orudyy@...che.org>
To: "dev@...d.apache.org" <dev@...d.apache.org>, "users@...d.apache.org" <users@...d.apache.org>, announce@...che.org, 
	"security@...che.org" <security@...che.org>, oss-security@...ts.openwall.com, 
	bugtraq@...urityfocus.com
Subject: [SECURITY] CVE-2019-0200: Apache Qpid Broker-J Denial of Service due
 to malformed AMQP 0-8 to 0-10 commands

CVE-2019-0200: Apache Qpid Broker-J Denial of Service due to malformed AMQP
0-8 to 0-10 commands

Severity: Critical

Vendor: The Apache Software Foundation

Versions Affected: 6.0.0-7.0.6 (inclusive), 7.1.0

Description:

A Denial of Service vulnerability [1] was found in Apache Qpid Broker-J
versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated
attacker to crash the broker instance by sending specially crafted
commands using AMQP protocol versions below 1.0 (AMQP 0-8, 0-9, 0-91 and
0-10).

Resolution:

Users of Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0
utilizing AMQP protocols 0-8, 0-9, 0-91, 0-10 must upgrade to Qpid

Broker-J versions 7.0.7 or 7.1.1 or later.

Mitigation:

If upgrade of the broker is not possible, the support for AMQP protocols
0-8...0-10 can be disabled on AMQP ports. The change can be made either
directly in the broker configuration file or by using management interfaces.

An example of REST API call restricting AMQP port to support only AMQP 1.0
using curl utility is provided below:

curl --user <user-name> -X POST -d '{"protocols":["AMQP_1_0"]}' \
https://<broker host>:<broker port>/api/latest/port/<port name>

References:
[1] https://issues.apache.org/jira/browse/QPID-8273

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@...d.apache.org
For additional commands, e-mail: dev-help@...d.apache.org

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.