bugtraq - CVE-2014-3629: Apache Qpid's qpidd can be induced to make http requests

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <545CF658.5050706@redhat.com>
Date: Fri, 07 Nov 2014 16:42:00 +0000
From: Gordon Sim <gsim@...hat.com>
To: "users@...d.apache.org" <users@...d.apache.org>,
  "dev@...d.apache.org" <dev@...d.apache.org>, announce@...che.org,
  "security@...che.org" <security@...che.org>, bugtraq@...urityfocus.com
Subject: CVE-2014-3629: Apache Qpid's qpidd can be induced to make http requests

    Apache Software Foundation - Security Advisory

       Apache Qpid's qpidd can be induced to make http requests

CVE-2014-3629  CVS: 3

Severity: Low

Vendor:

The Apache Software Foundation

Versions Affected:

Apache Qpid's qpidd up to and including version
0.30, where xml exchange module is loaded

Description:

The XML exchange type is an optional, dynamically loaded module for
qpidd that allows creation of exchanges that route messages based on
evaluating an xquery expression against them.

On parsing a message sent to an XML exchange, whose body is XML
containing a link to a DTD, the broker process will attempt to
retrieve the referenced resource(s). I.e. the broker process may be
induced to make outgoing HTTP connections by publishing a message
containing links to an XML exchange.

Solution:

A patch is available that prevents any retrieval of external entities 
referenced in the XML. This will be included in subsequent releases, but 
can be applied to 0.30 if desired. 
https://issues.apache.org/jira/secure/attachment/12680198/QPID-6218.patch

Common Vulnerability Score information:

If the XML exchange functionality is not required, the module in
question need not be loaded at all. This can be done either by moving
the module - named xml.so - out of the module directory, or by setting
the --no-module-dir option and adding an explicit --load-module
argument for every required module.

Where the XML exchange functionality is required, authorisation may be
enabled to prevent all but trusted users from creating or publishing
to xml exchanges.

Credit:

This issue was discovered by G. Geshev from MWR Labs

Common Vulnerability Score information:

CVSS Base Score                   3.5
Impact Subscore                   2.9
Exploitability Subscore           6.8
CVSS Temporal Score               3
CVSS Environmental Score          Not Defined
Modified Impact Subscore          Not Defined
Overall CVSS Score                3