Bug 861242 (CVE-2012-4460)

Summary: CVE-2012-4460 qpid-cpp: lack of bounds checking in qpid::framing::Buffer can lead to DoS if asserts are enabled
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: fweimer, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20130305,reported=20120523,source=redhat,cvss2=5.0/AV:N/AC:L/Au:N/C:N/I:N/A:P,fedora-all/qpid-cpp=notaffected,mrg-2/qpid-cpp=notaffected,mrg-1/qpid-cpp=notaffected,rhel-6/qpid-cpp=notaffected,openshift-1/qpid-cpp=notaffected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-03-06 17:22:19 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 824456    
Bug Blocks: 849724, 851360    

Description Vincent Danen 2012-09-27 18:09:39 EDT
The low-level serializing/deserializing methods (putOctet, getOctet and so on) in the qpid::framing::Buffer class do not perform bounds checks before the operation.  Instead, there is an assert after the operation which fails on out-of-bounds access.

If asserts are enabled, this results in a pre-authentication denial-of-service vulnerability.  Red Hat builds disable asserts, so they are not affected by this vulnerability.  Examining the protocol decoders showed that the read overrun is limited to very few bytes because all the large types perform proper length checking (so it seems impossible that an unmapped page can be reached and cause a crash).  Regarding write overruns, there is a check of the buffer size against the encoded size (which is conceptually not possible for the read case), so there should not be any write buffer overrun, assuming that the encoded size account is completely correct.

The suggestion is to remove the asserts from putOctet/getOctet etc. and replace them with bounds checks which throw exceptions on failure.

Acknowledgements:

This issue was discovered by Florian Weimer of the Red Hat Product Security Team.
Comment 3 Vincent Danen 2013-03-02 19:28:27 EST
Statement:

Not vulnerable. This issue did not affect the versions of qpid-cpp as shipped with Red Hat Enterprise MRG as asserts are not enabled.
Comment 4 Vincent Danen 2013-03-06 12:03:15 EST
This is corrected upstream:

https://svn.apache.org/viewvc?view=revision&revision=1453031


External References:

https://issues.apache.org/jira/browse/QPID-4629