Bug 986214 - (CVE-2013-4284) CVE-2013-4284 cumin: Denial of service due to improper handling of certain Ajax requests
CVE-2013-4284 cumin: Denial of service due to improper handling of certain Aj...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20131001,repor...
: Security
Depends On: 980366 983134 1014282
Blocks: 986234
  Show dependency treegraph
 
Reported: 2013-07-19 05:08 EDT by Jan Lieskovsky
Modified: 2014-12-09 16:53 EST (History)
10 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2013-07-19 05:08:30 EDT
A denial of service flaw was found in the way cumin, a unified management interface for the Messaging, Realtime, and Grid components of MRG, used to previously process certain Ajax update queries (the count of entries to be handled within one Ajax query was not limited for upper bound, processing of duplicate identical entries weren't optimized previously for effectiveness - to mention some examples). By issuing a specially-crafted Ajax request, a remote attacker could use this flaw to cause denial (excessive use of system CPU time and memory, possibly leading to cumin daemon to beterminated by OOM killer) of the cumin services.

This issue was found by Tomas Novacik of Red Hat.
Comment 3 Vincent Danen 2013-10-01 11:43:03 EDT
Created cumin tracking bugs for this issue:

Affects: fedora-all [bug 1014282]
Comment 4 errata-xmlrpc 2013-10-01 12:47:31 EDT
This issue has been addressed in following products:

  MRG for RHEL-5 v. 2

Via RHSA-2013:1295 https://rhn.redhat.com/errata/RHSA-2013-1295.html
Comment 5 errata-xmlrpc 2013-10-01 12:53:09 EDT
This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2013:1294 https://rhn.redhat.com/errata/RHSA-2013-1294.html

Note You need to log in before you can comment on or make changes to this bug.