CVE-2019-18609

An issue was discovered in amqphandleinput in amqpconnection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the handling of CONNECTIONSTATEHEADER. A rogue server could return a malicious frame header that leads to a smaller targetsize value than needed. This condition is then carried on to a memcpy function that copies too much data into a heap buffer.

References

Affected packages

Git / github.com/alanxz/rabbitmq-c

Affected ranges

Type: GIT
Repo: https://github.com/alanxz/rabbitmq-c
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

fc85be7123050b91b054e45b91c78d3241a5047a

Affected versions

0.*

0.2

librabbitmq-0.*

librabbitmq-0.1-amqp_0_8

librabbitmq-0.1-amqp_0_9_1

rabbitmq-c-v0.*

rabbitmq-c-v0.3.0

v0.*

v0.1

v0.2

v0.3.0

v0.4.0

v0.4.0-test

v0.5.0

v0.5.1

v0.5.2

v0.6.0

v0.7.0

v0.7.1

v0.8.0

v0.9.0-master

Database specific

vanir_signatures

[
    {
        "target": {
            "file": "librabbitmq/amqp_connection.c"
        },
        "digest": {
            "line_hashes": [
                "243814341639543304421666209824618441313",
                "183455278906321621184992196995879566177",
                "182357040532403947509468435054005069746",
                "225885130475099735426407665019057949072",
                "236275910161916524206322804826057425579",
                "44673271485574882728132486074926918671"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "source": "https://github.com/alanxz/rabbitmq-c/commit/fc85be7123050b91b054e45b91c78d3241a5047a",
        "deprecated": false,
        "id": "CVE-2019-18609-10f09550",
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "amqp_handle_input",
            "file": "librabbitmq/amqp_connection.c"
        },
        "digest": {
            "length": 3589.0,
            "function_hash": "238469019489558242787949093743451899054"
        },
        "signature_version": "v1",
        "source": "https://github.com/alanxz/rabbitmq-c/commit/fc85be7123050b91b054e45b91c78d3241a5047a",
        "deprecated": false,
        "id": "CVE-2019-18609-2c47032f",
        "signature_type": "Function"
    }
]