An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server could return a malicious frame header that leads to a smaller target_size value than needed. This condition is then carried on to a memcpy function that copies too much data into a heap buffer.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0078 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-18609:
    An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer     overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server     could return a malicious frame header that leads to a smaller target_size value than needed. This     condition is then carried on to a memcpy function that copies too much data into a heap buffer.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2022:0078 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-18609:
    An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer     overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server     could return a malicious frame header that leads to a smaller target_size value than needed. This     condition is then carried on to a memcpy function that copies too much data into a heap buffer.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-3949 advisory.

    [0.8.0-3]
    - Resolves: #1809991, CVE-2019-18609 - integer overflow

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:4445 advisory.

  - An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer     overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server     could return a malicious frame header that leads to a smaller target_size value than needed. This     condition is then carried on to a memcpy function that copies too much data into a heap buffer.
    (CVE-2019-18609)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has librabbitmq packages installed that are affected by a vulnerability:

  - An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer     overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server     could return a malicious frame header that leads to a smaller target_size value than needed. This     condition is then carried on to a memcpy function that copies too much data into a heap buffer.
    (CVE-2019-18609)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

alanxz reports :

When parsing a frame header, validate that the frame_size is less than or equal to INT32_MAX. Given frame_max is limited between 0 and INT32_MAX in amqp_login and friends, this does not change the API.
This prevents a potential buffer overflow when a malicious client sends a frame_size that is close to UINT32_MAX, in which causes an overflow when computing state->target_size resulting in a small value there. A buffer is then allocated with the small amount, then memcopy copies the frame_size writing to memory beyond the end of the buffer.

The remote NewStart CGSL host, running version MAIN 6.02, has librabbitmq packages installed that are affected by a vulnerability:

  - An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer     overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server     could return a malicious frame header that leads to a smaller target_size value than needed. This     condition is then carried on to a memcpy function that copies too much data into a heap buffer.
    (CVE-2019-18609)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4445 advisory.

  - librabbitmq: integer overflow in amqp_handle_input in amqp_connection.c leads to heap-based buffer     overflow (CVE-2019-18609)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4445 advisory.

    [0.9.0-2]
    - Resolves: #1809992, CVE-2019-18609

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4445 advisory.

    The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows     you to communicate with AMQP servers using protocol version 0-9-1.

    Security Fix(es):

    * librabbitmq: integer overflow in amqp_handle_input in amqp_connection.c leads to heap-based buffer     overflow (CVE-2019-18609)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - librabbitmq: integer overflow in amqp_handle_input in     amqp_connection.c leads to heap-based buffer overflow     (CVE-2019-18609)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3949 advisory.

  - An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer     overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server     could return a malicious frame header that leads to a smaller target_size value than needed. This     condition is then carried on to a memcpy function that copies too much data into a heap buffer.
    (CVE-2019-18609)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3949 advisory.

    The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows     you to communicate with AMQP servers using protocol version 0-9-1.

    Security Fix(es):

    * librabbitmq: integer overflow in amqp_handle_input in amqp_connection.c leads to heap-based buffer     overflow (CVE-2019-18609)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of librabbitmq installed on the remote host is prior to 0.1-0.2.hgfb6fca832fd2.3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1394 advisory.

    An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer     overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server     could return a malicious frame header that leads to a smaller target_size value than needed. This     condition is then carried on to a memcpy function that copies too much data into a heap buffer.
    (CVE-2019-18609)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-07 (RabbitMQ C client: Arbitrary code execution)

    It was discovered that RabbitMQ C client incorrectly handled certain       inputs.
  Impact :

    A remote attacker, by sending a specially crafted request, could       possibly execute arbitrary code with the privileges of the process or       cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

According to the version of the librabbitmq package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An issue was discovered in amqp_handle_input in     amqp_connection.c in rabbitmq-c 0.9.0. There is an     integer overflow that leads to heap memory corruption     in the handling of CONNECTION_STATE_HEADER. A rogue     server could return a malicious frame header that leads     to a smaller target_size value than needed. This     condition is then carried on to a memcpy function that     copies too much data into a heap     buffer.(CVE-2019-18609)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4214-2 advisory.

    USN-4214-1 fixed a vulnerability in RabbitMQ. This update provides the corresponding updates for Ubuntu     16.04 LTS and Ubuntu 18.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

**Added:**

  - amqp_ssl_socket_get_context can be used to get the     current OpenSSL CTX* associated with a connection.

**Changed:**

  - openssl: missing OpenSSL config is ignored as an OpenSSL     init error (#523)

  - AMQP_DEFAULT_MAX_CHANNELS is now set to 2047 to follow     current default channel limit in the RabbitMQ broker.
    (#513)

**Fixed:**

  - add additional input validation to prevent integer     overflow when parsing a frame header. This addresses
    **CVE-2019-18609**.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was an integer overflow vulnerability in librabbitmq, a library for robust messaging between applications and servers.

For Debian 8 'Jessie', this issue has been fixed in librabbitmq version 0.5.2-2+deb8u1.

We recommend that you upgrade your librabbitmq packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that RabbitMQ incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
239575	TencentOS Server 3: librabbitmq (TSSA-2022:0078)	Nessus	Tencent Local Security Checks	critical
236448	Alibaba Cloud Linux 3 : 0078: librabbitmq (ALINUX3-SA-2022:0078)	Nessus	Alibaba Cloud Linux Local Security Checks	critical
180941	Oracle Linux 7 : librabbitmq (ELSA-2020-3949)	Nessus	Oracle Linux Local Security Checks	critical
157554	AlmaLinux 8 : librabbitmq (ALSA-2020:4445)	Nessus	Alma Linux Local Security Checks	critical
154570	NewStart CGSL CORE 5.05 / MAIN 5.05 : librabbitmq Vulnerability (NS-SA-2021-0163)	Nessus	NewStart CGSL Local Security Checks	critical
151120	FreeBSD : RabbitMQ-C -- integer overflow leads to heap corruption (7c555ce3-658d-4589-83dd-4b6a31c5d610)	Nessus	FreeBSD Local Security Checks	critical
147377	NewStart CGSL MAIN 6.02 : librabbitmq Vulnerability (NS-SA-2021-0072)	Nessus	NewStart CGSL Local Security Checks	critical
145965	CentOS 8 : librabbitmq (CESA-2020:4445)	Nessus	CentOS Local Security Checks	critical
142755	Oracle Linux 8 : librabbitmq (ELSA-2020-4445)	Nessus	Oracle Linux Local Security Checks	critical
142436	RHEL 8 : librabbitmq (RHSA-2020:4445)	Nessus	Red Hat Local Security Checks	critical
141652	Scientific Linux Security Update : librabbitmq on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	critical
141595	CentOS 7 : librabbitmq (RHSA-2020:3949)	Nessus	CentOS Local Security Checks	critical
141010	RHEL 7 : librabbitmq (RHSA-2020:3949)	Nessus	Red Hat Local Security Checks	critical
138636	Amazon Linux AMI : librabbitmq (ALAS-2020-1394)	Nessus	Amazon Linux Local Security Checks	critical
134474	GLSA-202003-07 : RabbitMQ C client: Arbitrary code execution	Nessus	Gentoo Local Security Checks	critical
133997	EulerOS 2.0 SP8 : librabbitmq (EulerOS-SA-2020-1163)	Nessus	Huawei Local Security Checks	critical
133917	EulerOS 2.0 SP5 : librabbitmq (EulerOS-SA-2020-1116)	Nessus	Huawei Local Security Checks	critical
132012	Ubuntu 16.04 LTS / 18.04 LTS : RabbitMQ vulnerability (USN-4214-2)	Nessus	Ubuntu Local Security Checks	critical
131843	Fedora 30 : librabbitmq (2019-dd7c8f5435)	Nessus	Fedora Local Security Checks	critical
131841	Fedora 31 : librabbitmq (2019-8730b65158)	Nessus	Fedora Local Security Checks	critical
131780	Debian DLA-2022-1 : librabbitmq security update	Nessus	Debian Local Security Checks	critical
131761	Ubuntu 19.04 / 19.10 : librabbitmq vulnerability (USN-4214-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2019-18609

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical