Lucene search

[email protected]CVE-2009-5006

HistoryOct 18, 2010 - 5:00 p.m.

CVE-2009-5006

2010-10-1817:00:02

[email protected]

web.nvd.nist.gov

apache qpid

sessionadapter

exchangehandlerimpl

vulnerability

denial of service

nvd

cve-2009-5006

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

6.4 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.9%

JSON

The SessionAdapter::ExchangeHandlerImpl::checkAlternate function in broker/SessionAdapter.cpp in the C++ Broker component in Apache Qpid before 0.6, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote authenticated users to cause a denial of service (NULL pointer dereference, daemon crash, and cluster outage) by attempting to modify the alternate of an exchange.

Affected configurations

NVD

Node

apacheqpidRange≤0.5

AND

redhatenterprise_mrgRange≤1.2.2

redhatenterprise_mrgMatch1.0

redhatenterprise_mrgMatch1.0.1

redhatenterprise_mrgMatch1.0.2

redhatenterprise_mrgMatch1.0.3

redhatenterprise_mrgMatch1.1.1

redhatenterprise_mrgMatch1.1.2

redhatenterprise_mrgMatch1.2

CPENameOperatorVersion
apache:qpidapache qpidle0.5
redhat:enterprise_mrgredhat enterprise mrgle1.2.2
redhat:enterprise_mrgredhat enterprise mrgeq1.0
redhat:enterprise_mrgredhat enterprise mrgeq1.0.1
redhat:enterprise_mrgredhat enterprise mrgeq1.0.2
redhat:enterprise_mrgredhat enterprise mrgeq1.0.3
redhat:enterprise_mrgredhat enterprise mrgeq1.1.1
redhat:enterprise_mrgredhat enterprise mrgeq1.1.2
redhat:enterprise_mrgredhat enterprise mrgeq1.2

CPE	Name	Operator	Version
apache:qpid	apache qpid	le	0.5
redhat:enterprise_mrg	redhat enterprise mrg	le	1.2.2
redhat:enterprise_mrg	redhat enterprise mrg	eq	1.0
redhat:enterprise_mrg	redhat enterprise mrg	eq	1.0.1
redhat:enterprise_mrg	redhat enterprise mrg	eq	1.0.2
redhat:enterprise_mrg	redhat enterprise mrg	eq	1.0.3
redhat:enterprise_mrg	redhat enterprise mrg	eq	1.1.1
redhat:enterprise_mrg	redhat enterprise mrg	eq	1.1.2
redhat:enterprise_mrg	redhat enterprise mrg	eq	1.2

References

secunia.com/advisories/41710

secunia.com/advisories/41812

svn.apache.org/viewvc?revision=811188&view=revision

www.vupen.com/english/advisories/2010/2684

bugzilla.redhat.com/show_bug.cgi?id=642377

issues.apache.org/jira/browse/QPID-2080

rhn.redhat.com/errata/RHSA-2010-0773.html

rhn.redhat.com/errata/RHSA-2010-0774.html

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

6.4 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.9%

JSON

Related for CVE-2009-5006

prion1 veracode1 cvelist1 nvd1 redhat1