A pointer overflow, with code execution, was discovered in ZeroMQ libzmq (aka 0MQ) 4.2.x and 4.3.x before 4.3.1. A v2_decoder.cpp zmq::v2_decoder_t::size_ready integer overflow allows an authenticated attacker to overwrite an arbitrary amount of bytes beyond the bounds of a buffer, which can be leveraged to run arbitrary code on the target system. The memory layout allows the attacker to inject OS commands into a data structure located immediately after the problematic buffer (i.e., it is not necessary to use a typical buffer-overflow exploitation technique that changes the flow of control).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A pointer overflow, with code execution, was discovered in ZeroMQ libzmq (aka 0MQ) 4.2.x and 4.3.x before
    4.3.1. A v2_decoder.cpp zmq::v2_decoder_t::size_ready integer overflow allows an authenticated attacker to
    overwrite an arbitrary amount of bytes beyond the bounds of a buffer, which can be leveraged to run
    arbitrary code on the target system. The memory layout allows the attacker to inject OS commands into a
    data structure located immediately after the problematic buffer (i.e., it is not necessary to use a
    typical buffer-overflow exploitation technique that changes the flow of control). (CVE-2019-6250)

An update of the zeromq package has been released.

The remote host is affected by the vulnerability described in GLSA-201903-22 (ZeroMQ: Code execution)

    Please reference the CVE for details.
  Impact :

    Please reference the CVE for details.
  Workaround :

    There is no known workaround at this time.

This update for zeromq fixes the following issues :

Security issue fixed :

  - CVE-2019-6250: fix a remote execution vulnerability due     to pointer arithmetic overflow (bsc#1121717) The     following tracked packaging change is included :

  - boo1082318: correctly mark license files as licence     instead of documentation.

This update was imported from the SUSE:SLE-15:Update update project.

A vulnerability has been found that would allow attackers to direct a peer to jump to and execute from an address indicated by the attacker.
This issue has been present since v4.2.0. Older releases are not affected.

NOTE: The attacker needs to know in advance valid addresses in the peer's memory to jump to, so measures like ASLR are effective mitigations.

NOTE: this attack can only take place after authentication, so peers behind CURVE/GSSAPI are not vulnerable to unauthenticated attackers.

This update for zeromq fixes the following issues :

Security issue fixed :

  - CVE-2019-6250: fix a remote execution vulnerability due     to pointer arithmetic overflow (bsc#1121717)

This update for zeromq fixes the following issues :

Security issue fixed :

CVE-2019-6250: fix a remote execution vulnerability due to pointer arithmetic overflow (bsc#1121717)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Guido Vranken discovered that an incorrect bounds check in ZeroMQ, a lightweight messaging kernel, could result in the execution of arbitrary code.

ID	Name	Product	Family	Severity
424744	Alpine: multiple libzmq packages, multiple zeromq packages: security update to 4.3.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
424744	Alpine: multiple libzmq packages, multiple zeromq packages: security update to 4.3.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
407959	Alpine: zeromq: security update to 4.2.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
407959	Alpine: zeromq: security update to 4.2.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400625	Alpine: multiple libzmq packages, multiple zeromq packages: security update to 4.2.5-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400625	Alpine: multiple libzmq packages, multiple zeromq packages: security update to 4.2.5-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
128733	Photon OS 3.0: Zeromq PHSA-2019-3.0-0026	Nessus	PhotonOS Local Security Checks	high
123428	GLSA-201903-22 : ZeroMQ: Code execution	Nessus	Gentoo Local Security Checks	high
121414	openSUSE Security Update : zeromq (openSUSE-2019-87)	Nessus	SuSE Local Security Checks	high
121405	FreeBSD : libzmq4 -- Remote Code Execution Vulnerability (8e48365a-214d-11e9-9f8a-0050562a4d7b)	Nessus	FreeBSD Local Security Checks	high
121288	openSUSE Security Update : zeromq (openSUSE-2019-64)	Nessus	SuSE Local Security Checks	high
121240	SUSE SLED15 / SLES15 Security Update : zeromq (SUSE-SU-2019:0110-1)	Nessus	SuSE Local Security Checks	high
121167	Debian DSA-4368-1 : zeromq3 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-6250

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high