CVE-2015-0203: Medium severity apache qpid vulnerability
It was reported [1] that certain unexpected protocol sequences cause the broker process to crash due to insufficient checking. Three distinct cases were identified as follows:
The AMQP 0-10 protocol defines a sequence set containing id ranges. The qpidd broker can be crashed by sending it a sequence-set containing an invalid range, where the start of the range is after the end. This condition causes an assertion, which causes the broker process to exit.
The AMQP 0-10 protocol defines header- and body- segments that may follow certain commands. The only command for which such segments are expected by qpidd is the message-transfer command. If another command is sent that includes header and/or body segments, this will cause a segmentation fault in the broker process, causing it then to exit.
The AMQP 0-10 protocol defines a session-gap control that can be sent on any established session. The qpidd broker does not support this control and responds with an appropriate error if requested on an established session. However, if the control is sent before the session is opened, the brokers handling causes an assertion which results in the broker process exiting.
A patch is available (https://issues.apache.org/jira/browse/QPID-6310) that handles all these errors by sending an exception control to the remote peer and leave the broker available to all other users.
[1]: http://mail-archives.apache.org/modmbox/qpid-users/201501.mbox/%3c54B4F4AC.8030109@apache.org%3e
Acknowledgements:
Red Hat would like to thank the Apache Software Foundation for reporting this issue. Upstream acknowledges G. Geshev from MWR Labs as the original reporter.
Other sources
The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via an AMQP message with (1) an invalid range in a sequence set, (2) content-bearing methods other than message-transfer, or (3) a session-gap control before a corresponding session-attach.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0203?
CVE-2015-0203 is classified as a high severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2015-0203?
To mitigate CVE-2015-0203, upgrade Apache Qpid to version 0.31 or later.
What can be exploited in CVE-2015-0203?
CVE-2015-0203 can be exploited by sending specific AMQP messages that trigger a crash in the qpidd broker.
Who is affected by CVE-2015-0203?
Users of Apache Qpid versions 0.30 and earlier are affected by CVE-2015-0203.
What types of messages can trigger CVE-2015-0203?
Messages with an invalid range in a sequence set, content-bearing methods other than message-transfer, or session-gap control can trigger CVE-2015-0203.