Bug 1164848 (CVE-2014-3629)

Summary:	CVE-2014-3629 qpid-cpp: XXE vulnerability causes outgoing HTTP connections
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	abaron, aortega, apevec, ayoung, bhu, bkearney, bressers, chrisw, cpelland, dallan, esammons, gkotton, iboverma, jose.p.oliveira.oss, jross, katello-bugs, kpalko, lhh, lpeer, markmc, matt, mcressma, messaging-bugs, mmccune, nsantos, rbryant, rrajasek, sclewis, tjay, tross, williams, yeylon
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	apache qpid 0.31	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-07-31 04:30:38 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1159305

Description Vincent Danen 2014-11-17 17:11:17 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2014-3629 to
the following vulnerability:

Name: CVE-2014-3629
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3629
Assigned: 20140514
Reference: 20141107 CVE-2014-3629: Apache Qpid's qpidd can be induced to make http requests
Reference: http://www.securityfocus.com/archive/1/archive/1/533943/100/0/threaded
Reference: http://packetstormsecurity.com/files/129034/Apache-Qpid-0.30-Induced-HTTP-Requests.html
Reference: http://www.securityfocus.com/bid/71004
Reference: http://secunia.com/advisories/62235
Reference: http://xforce.iss.net/xforce/xfdb/98575

XML external entity (XXE) vulnerability in the XML Exchange module in
Apache Qpid 0.30 allows remote attackers to cause outgoing HTTP
connections via a crafted message.


Upstream notes the following mitigations:

If the XML exchange functionality is not required, the module in
question need not be loaded at all. This can be done either by moving
the module - named xml.so - out of the module directory, or by setting
the --no-module-dir option and adding an explicit --load-module
argument for every required module.

Where the XML exchange functionality is required, authorisation may be
enabled to prevent all but trusted users from creating or publishing
to xml exchanges.


A patch to correct this is available:

https://svn.apache.org/viewvc?view=revision&revision=r1637402
https://issues.apache.org/jira/browse/QPID-6218

This has also been fixed in Fedora already:

https://admin.fedoraproject.org/updates/FEDORA-2014-14564/qpid-cpp-0.26-12.fc19

Comment 1 Vincent Danen 2015-07-31 04:30:38 UTC

The XML exchange type is an optional and dynamically-loaded module, where authorization may be enabled to prevent untrusted users from creating, or publishing to, XML exchanges.  In order for this to be exploited it first needs to be enabled (non-default) and you must be an authenticated user.

Statement:

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.