PT-2015-4365 · Zeromq+2 · Libzmq+2

Hintjens · Publicado 2015-05-10 · Atualizado 2024-06-15 · CVE-2014-9721

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions libzmq versions prior to 4.0.6 libzmq versions 4.1.x prior to 4.1.1

Description The issue allows remote attackers to conduct downgrade attacks, bypassing security mechanisms of the ZMTP v3 protocol by using a ZMTP v2 or earlier header.

Recommendations For libzmq versions prior to 4.0.6, update to version 4.0.6 or later. For libzmq versions 4.1.x prior to 4.1.1, update to version 4.1.1 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2017-1102

CVE-2014-9721

DSA-3255-1

OPENSUSE-SU-2024:10038-1

SUSE-FU-2022:0444-1

SUSE-FU-2022:0445-1

SUSE-SU-2015:1510-1

SUSE-SU-2015_1510-1

Produtos afetados

Alt Linux

Suse

Libzmq

Referências · 31

• https://github.com/zeromq/libzmq/issues/1273 · Nota
• https://github.com/zeromq/zeromq4-x/commit/b6e3e0f601e2c1ec1f3aac880ed6a3fe63043e51 · Nota
• https://suse.com/support/update/announcement/2015/suse-su-20151510-1 · Nota
• https://cve.org/CVERecord?id=CVE-2014-9721 · Nota de Segurança
• https://lists.suse.com/pipermail/sle-security-updates/2015-September/001578.html · Nota
• https://suse.com/security/cve/CVE-2014-9721.html · Nota
• http://openwall.com/lists/oss-security/2015/05/07/8 · Nota
• https://bugzilla.suse.com/931978 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10038-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2015:1510-1 · Aviso do Fabricante
• https://packages.debian.org/src:zeromq3 · Nota
• https://ubuntu.com/security/CVE-2014-9721 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159176.html · Aviso do Fabricante
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• https://suse.com/security/cve/CVE-2014-7203 · Nota