PT-2023-9000 · Microsoft+2 · Azure Uamqp+2

Ericwolz · Publicado 2023-12-06 · Atualizado 2024-02-05 · CVE-2024-21646

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Azure uAMQP versions prior to 2024-01-01

Description The issue is related to an integer overflow or wraparound or memory safety issue in the Azure uAMQP library, which is a general-purpose C library for AMQP 1.0. This library is used by several clients to implement AMQP protocol communication. When clients using this library receive crafted binary type data, the issue can occur and may cause remote code execution.

Recommendations For Azure uAMQP versions prior to 2024-01-01, update to the release 2024-01-01 or later to patch the vulnerability. As a temporary workaround, consider restricting the reception of crafted binary type data to minimize the risk of exploitation.

Exploit

Correção

RCE

Integer Overflow

Code Injection

Enumeração de Fraquezas

CWE-190

CWE-94

Identificadores relacionados

AZL-33284

AZL-34555

BDU:2024-02931

CVE-2024-21646

GHSA-J29M-P99G-7HPV

OPENSUSE-SU-2024:13643-1

OPENSUSE-SU-2024_0323-1

SUSE-SU-2024:0323-1

SUSE-SU-2024_0323-1

Produtos afetados

Azure Uamqp

Debian

Suse

Referências · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21646.json · Exploit
• https://github.com/Azure/azure-uamqp-c/commit/12ddb3a31a5a97f55b06fa5d74c59a1d84ad78fe · Correção
• https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-j29m-p99g-7hpv · Aviso do Fabricante
• https://github.com/Azure/azure-uamqp-python/commit/c85efcd12c249999eb8a1064b7d4fd8c7715c780 · Nota
• https://github.com/Azure/azure-uamqp-python/issues/372 · Nota
• https://security-tracker.debian.org/tracker/CVE-2024-21646 · Aviso do Fabricante
• https://t.me/cvenotify/67258 · Publicação no Telegram
• https://osv.dev/vulnerability/AZL-33284 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-02931 · Nota de Segurança
• https://moxa.com/en/support/product-support/security-advisory/mpsa-248041-aig-301-series-azure-uamqp-vulnerabilities · Nota
• https://cve.org/CVERecord?id=CVE-2024-21646 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2024-21646 · Nota de Segurança
• https://osv.dev/vulnerability/AZL-34555 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2024:0323-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2024-21646 · Aviso do Fabricante