Bug 1147315 (CVE-2014-7203)

Summary:	CVE-2014-7203 zeromq: CurveZMQ does not mandate replay attack detection
Product:	[Other] Security Response	Reporter:	Wade Mealing <wmealing>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	andrewniemants, djorm, jose.p.oliveira.oss, jrusnack, mrunge, tomspur, weli
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-10-09 04:44:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1147291

Description Wade Mealing 2014-09-29 01:55:51 UTC

libzmq (ZeroMQ/C++) did not implement a uniqueness check on connection
nonces, and the CurveZMQ RFC was ambiguous about nonce validation.

This allows an attacker to use a replay attacks on zeroMQ connections.

Comment 1 Murray McAllister 2014-09-29 02:40:55 UTC

Upstream commit:

https://github.com/steamraven/libzmq/commit/0900a489213d74feb86fc0b343308fe7884a2a3c

From a brief inspection, it appears as though zeromq and zeromq 3 in Fedora may not be affected.

Comment 2 Wade Mealing 2014-09-29 08:53:18 UTC

In the version zeromq3-3.2.4-1.el6.src.rpm from EPEL, this -doesnt- even seem to mention the word nonce, or have any curve_client.cpp file, so I'm going to say that 1.2  its not effected by this issue, i'm not sure about 1.3

Comment 4 Wade Mealing 2014-10-08 00:27:28 UTC

Statement:

This issue did not affect the versions of zeromq as shipped with Inktank Ceph Enterprise 1.2 and 1.3.

Comment 5 Wade Mealing 2014-10-09 04:39:36 UTC

The fedora 20 release zeromq3-3.2.4-1.fc20.src.rpm ,is the same release that was audited by the inktank developers found to be not affected by this issue.