CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2016:0368 advisory.

    RabbitMQ is an implementation of AMQP, the emerging standard for high     performance enterprise messaging. The RabbitMQ server is a robust and     scalable implementation of an AMQP broker.

    A cross-site scripting vulnerability was discovered in RabbitMQ, which     allowed using api/ path info to inject and receive data. A remote attacker     could use this flaw to create an /api/... URL, forcing a server error     that resulted in the server returning an HTML page with embedded text from     the URL (not escaped). (CVE-2014-9649)

    A response-splitting vulnerability was discovered in RabbitMQ.
    An /api/definitions URL could be specified, which then caused an arbitrary     additional header to be returned. A remote attacker could use this flaw to     inject arbitrary HTTP headers and possibly gain access to secure data.
    (CVE-2014-9650)

    All rabbitmq-server users are advised to upgrade to these updated packages,     which contain backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2016:0369 advisory.

    RabbitMQ is an implementation of AMQP, the emerging standard for high     performance enterprise messaging. The RabbitMQ server is a robust and     scalable implementation of an AMQP broker.

    A cross-site scripting vulnerability was discovered in RabbitMQ, which     allowed using api/ path info to inject and receive data. A remote attacker     could use this flaw to create an /api/... URL, forcing a server error     that resulted in the server returning an HTML page with embedded text from     the URL (not escaped). (CVE-2014-9649)

    A response-splitting vulnerability was discovered in RabbitMQ.
    An /api/definitions URL could be specified, which then caused an arbitrary     additional header to be returned. A remote attacker could use this flaw to     inject arbitrary HTTP headers and possibly gain access to secure data.
    (CVE-2014-9650)

    This update also fixes the following bug:

    * Previously, if the rabbit_mirror_queue_master did not return when using     HA and 'auto_delete' queues, the RabbitMQ server blocked channels during     termination. These channels would then have no associated connections and     were displayed as 'unknown'. This issue has been resolved. (BZ#1303748)

    All rabbitmq-server users are advised to upgrade to these updated packages,     which contain backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2016:0308 advisory.

    RabbitMQ is an implementation of AMQP, the emerging standard for high     performance enterprise messaging. The RabbitMQ server is a robust and     scalable implementation of an AMQP broker.

    A cross-site scripting vulnerability was discovered in RabbitMQ, which     allowed using api/ path info to inject and receive data. A remote     attacker could use this flaw to create an /api/... URL, forcing a     server error that resulted in the server returning an HTML page with     embedded text from the URL (not escaped). (CVE-2014-9649)

    A response-splitting vulnerability was discovered in RabbitMQ. An     /api/definitions URL could be specified, which then caused an arbitrary     additional header to be returned. A remote attacker could use this flaw     to inject arbitrary HTTP headers and possibly gain access to secure data.
    (CVE-2014-9650)

    This update also fixes the following bug:

    * Previously, if the rabbit_mirror_queue_master did not return when using     HA and 'auto_delete' queues, the RabbitMQ server blocked channels during     termination. These channels would then have no associated connections and     were displayed as 'unknown'. This issue has been resolved. (BZ#1303747)

    All rabbitmq-server users are advised to upgrade to these updated packages,     which contain backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
234396	RHEL 6 : rabbitmq-server (RHSA-2016:0368)	Nessus	Red Hat Local Security Checks	medium
234367	RHEL 7 : rabbitmq-server (RHSA-2016:0369)	Nessus	Red Hat Local Security Checks	medium
210224	RHEL 7 : rabbitmq-server (RHSA-2016:0308)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2014-9650

medium

Tenable Plugins

medium

medium

medium