CVE-2012-4460: Buffer Overflow
First published: Thu Sep 27 2012(Updated: )
The low-level serializing/deserializing methods (putOctet, getOctet and so on) in the qpid::framing::Buffer class do not perform bounds checks before the operation. Instead, there is an assert after the operation which fails on out-of-bounds access. If asserts are enabled, this results in a pre-authentication denial-of-service vulnerability. Red Hat builds disable asserts, so they are not affected by this vulnerability. Examining the protocol decoders showed that the read overrun is limited to very few bytes because all the large types perform proper length checking (so it seems impossible that an unmapped page can be reached and cause a crash). Regarding write overruns, there is a check of the buffer size against the encoded size (which is conceptually not possible for the read case), so there should not be any write buffer overrun, assuming that the encoded size account is completely correct. The suggestion is to remove the asserts from putOctet/getOctet etc. and replace them with bounds checks which throw exceptions on failure. Acknowledgements: This issue was discovered by Florian Weimer of the Red Hat Product Security Team.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Qpid | <=0.20 | |
| Apache Qpid | =0.5 | |
| Apache Qpid | =0.6 | |
| Apache Qpid | =0.7 | |
| Apache Qpid | =0.8 | |
| Apache Qpid | =0.9 | |
| Apache Qpid | =0.10 | |
| Apache Qpid | =0.11 | |
| Apache Qpid | =0.12 | |
| Apache Qpid | =0.13 | |
| Apache Qpid | =0.14 | |
| Apache Qpid | =0.15 | |
| Apache Qpid | =0.16 | |
| Apache Qpid | =0.17 | |
| Apache Qpid | =0.18 | |
| Apache Qpid | =0.19 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://svn.apache.org/viewvc?view=revision&revision=1453031
- https://issues.apache.org/jira/browse/QPID-4629
- https://bugzilla.redhat.com/show_bug.cgi?id=861242
- http://svn.apache.org/viewvc?view=revision&revision=1453031
- https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%20%220.21%22%20AND%20project%20%3D%20QPID
Frequently Asked Questions
What is the severity of CVE-2012-4460?
CVE-2012-4460 has a medium severity level due to potential out-of-bounds access leading to application crashes.
How do I fix CVE-2012-4460?
To fix CVE-2012-4460, update Apache Qpid to a version greater than 0.20, as it addresses the bounds check issues.
Which versions of Apache Qpid are affected by CVE-2012-4460?
CVE-2012-4460 affects Apache Qpid versions from 0.5 to 0.20 and includes various releases in between.
What can happen if CVE-2012-4460 is exploited?
Exploitation of CVE-2012-4460 can lead to application crashes and potentially allow for denial-of-service conditions.
Are there any workarounds for CVE-2012-4460?
Currently, the best workaround for CVE-2012-4460 is to disable asserts, although this is not a permanent solution and updating is recommended.
- collector/redhat-bugzilla
- alias/CVE-2012-4460
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/tags
- vendor/apache
- canonical/apache qpid
- version/apache qpid/0.20
- version/apache qpid/0.5
- version/apache qpid/0.6
- version/apache qpid/0.7
- version/apache qpid/0.8
- version/apache qpid/0.9
- version/apache qpid/0.10
- version/apache qpid/0.11
- version/apache qpid/0.12
- version/apache qpid/0.13
- version/apache qpid/0.14
- version/apache qpid/0.15
- version/apache qpid/0.16
- version/apache qpid/0.17
- version/apache qpid/0.18
- version/apache qpid/0.19