CVE-2012-6619: Input Validation
MongoDB was found to be affected by a memory over-read bug that can be used by an authenticated user (if applicable) to obtain raw MongoDB server process memory contents via incorrect BSON object length.
This issue does not seem to cross a security boundary under most deployments, but for some it could, like differently-privileged MongoDB users, data already deleted from the DB yet staying in process memory, or/and metadata that is not normally retrievable.
References: http://seclists.org/oss-sec/2014/q1/27 http://blog.ptsecurity.com/2012/11/attacking-mongodb.html https://github.com/cyberpunkych/attackingmongodb (The files used for the attack demonstration.)
Other sources
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service (crash) or read system memory via a crafted BSON object in the column name in an insert command, which triggers a buffer over-read.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6619?
CVE-2012-6619 has a moderate severity rating due to its potential to expose raw memory contents to authenticated users.
How do I fix CVE-2012-6619?
To fix CVE-2012-6619, upgrade MongoDB to version 2.3.2 or later.
Which versions of MongoDB are affected by CVE-2012-6619?
CVE-2012-6619 affects MongoDB versions prior to 2.3.2, including 2.3.1 and earlier versions.
Can an unauthenticated user exploit CVE-2012-6619?
No, CVE-2012-6619 requires authentication to exploit the memory over-read vulnerability.
What type of vulnerability is CVE-2012-6619 classified as?
CVE-2012-6619 is classified as a memory over-read vulnerability.