CVE-2012-2145: Medium severity apache qpid vulnerability
A flaw was found in the way that qpidd handled incoming connections. If a client application were to send a large number of connections to qpidd, without terminating the connections with an incomplete handshake, qpidd would keep a file descriptor open for each connection. This could lead to excessive resource consumption by qpidd and could also block other legitimate connection requests.
This flaw has also been reported upstream:
https://issues.apache.org/jira/browse/QPID-2616 (RFE for disconnecting clients on incomplete handshakes)
https://issues.apache.org/jira/browse/QPID-4021 (the actual flaw)
Other sources
Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of incomplete connections.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2145?
CVE-2012-2145 has been assigned a medium severity rating due to the potential for resource exhaustion.
How do I fix CVE-2012-2145?
To fix CVE-2012-2145, upgrade Apache Qpid to a version later than 0.17 or apply any available patches addressing this vulnerability.
What versions of Apache Qpid are affected by CVE-2012-2145?
Apache Qpid versions 0.6 through 0.17 are affected by CVE-2012-2145.
What kind of attack does CVE-2012-2145 enable?
CVE-2012-2145 enables potential denial of service attacks due to too many open file descriptors.
Is there a way to mitigate CVE-2012-2145 without upgrading?
Temporary mitigation of CVE-2012-2145 can be attempted by limiting incoming connection requests through firewall rules or connection rate limiting.