Apache Qpid 0.30 Induced HTTP Requests

2014.11.11
Credit: Geshev
Risk: Low
Local: No
Remote: Yes
CWE: CWE-19


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

Apache Software Foundation - Security Advisory Apache Qpid's qpidd can be induced to make http requests CVE-2014-3629 CVS: 3 Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Qpid's qpidd up to and including version 0.30, where xml exchange module is loaded Description: The XML exchange type is an optional, dynamically loaded module for qpidd that allows creation of exchanges that route messages based on evaluating an xquery expression against them. On parsing a message sent to an XML exchange, whose body is XML containing a link to a DTD, the broker process will attempt to retrieve the referenced resource(s). I.e. the broker process may be induced to make outgoing HTTP connections by publishing a message containing links to an XML exchange. Solution: A patch is available that prevents any retrieval of external entities referenced in the XML. This will be included in subsequent releases, but can be applied to 0.30 if desired. https://issues.apache.org/jira/secure/attachment/12680198/QPID-6218.patch Common Vulnerability Score information: If the XML exchange functionality is not required, the module in question need not be loaded at all. This can be done either by moving the module - named xml.so - out of the module directory, or by setting the --no-module-dir option and adding an explicit --load-module argument for every required module. Where the XML exchange functionality is required, authorisation may be enabled to prevent all but trusted users from creating or publishing to xml exchanges. Credit: This issue was discovered by G. Geshev from MWR Labs Common Vulnerability Score information: CVSS Base Score 3.5 Impact Subscore 2.9 Exploitability Subscore 6.8 CVSS Temporal Score 3 CVSS Environmental Score Not Defined Modified Impact Subscore Not Defined Overall CVSS Score 3


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top