Summaryinfo

A vulnerability classified as critical was found in RabbitMQ 0.9.0. This vulnerability affects the function memcpy of the file amqp_connection.c. The manipulation of the argument CONNECTION_STATE_HEADER leads to integer overflow. This vulnerability was named CVE-2019-18609. The attack can be initiated remotely. There is no exploit available. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Detailsinfo

A vulnerability classified as critical has been found in RabbitMQ 0.9.0. This affects the function memcpy of the file amqp_connection.c. The manipulation of the argument CONNECTION_STATE_HEADER with an unknown input leads to a integer overflow vulnerability. CWE is classifying the issue as CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server could return a malicious frame header that leads to a smaller target_size value than needed. This condition is then carried on to a memcpy function that copies too much data into a heap buffer.

The weakness was shared 12/01/2019 (GitHub Repository). The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2019-18609 since 10/29/2019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• RabbitMQ

Version

• 0.9.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion