FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

RabbitMQ-C -- integer overflow leads to heap corruption

Affected packages
rabbitmq-c < 0.10.0
rabbitmq-c-devel < 0.10.0

Details

VuXML ID 7c555ce3-658d-4589-83dd-4b6a31c5d610
Discovery 2019-10-29
Entry 2021-06-25

alanxz reports:

When parsing a frame header, validate that the frame_size is less than or equal to INT32_MAX. Given frame_max is limited between 0 and INT32_MAX in amqp_login and friends, this does not change the API. This prevents a potential buffer overflow when a malicious client sends a frame_size that is close to UINT32_MAX, in which causes an overflow when computing state->target_size resulting in a small value there. A buffer is then allocated with the small amount, then memcopy copies the frame_size writing to memory beyond the end of the buffer.

References

CVE Name CVE-2019-18609
URL https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18609