FKIE_CVE-2012-4460

Vulnerability from fkie_nvd - Published: 2013-03-14 03:10 - Updated: 2025-04-11 00:51
Severity ?
Summary
The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read, but it might not trigger a crash.
References
secalert@redhat.comhttp://svn.apache.org/viewvc?view=revision&revision=1453031Patch
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=861242
secalert@redhat.comhttps://issues.apache.org/jira/browse/QPID-4629
secalert@redhat.comhttps://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%20%220.21%22%20AND%20project%20%3D%20QPID
af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1453031Patch
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=861242
af854a3a-2127-422b-91ae-364da2661108https://issues.apache.org/jira/browse/QPID-4629
af854a3a-2127-422b-91ae-364da2661108https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%20%220.21%22%20AND%20project%20%3D%20QPID
Impacted products
Vendor Product Version
apache qpid *
apache qpid 0.5
apache qpid 0.6
apache qpid 0.7
apache qpid 0.8
apache qpid 0.9
apache qpid 0.10
apache qpid 0.11
apache qpid 0.12
apache qpid 0.13
apache qpid 0.14
apache qpid 0.15
apache qpid 0.16
apache qpid 0.17
apache qpid 0.18
apache qpid 0.19
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:qpid:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2EFF35CD-0D3D-4B29-8E7A-9C39D7358A3A",
              "versionEndIncluding": "0.20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "71A147B7-2E6B-4E7A-8C68-BEDFCACD57AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "760A5796-9BB5-45A3-AB0E-D3639D487A76",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "D441FDC2-CA4E-43C5-A3DD-3715641E59A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "79CB1E30-BDD9-451E-A366-EE19C2E00AF0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "8690F211-CE64-4799-87C5-F2AEDB0500EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "469FC441-523B-4C78-9B2D-46B8CCE8811E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB64A222-C258-44BF-A83D-CFE1204F8009",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "C584B299-0BB9-4B4F-B0BC-11DE222F1F17",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "D74323FF-612A-48EE-A03E-D49CAD828101",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "21261207-0DF5-460A-9F9B-F8CADB78DAF7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5A6F2E8-325C-4071-9862-8242B730B147",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "578FB3FD-EA55-4A39-94D4-F4194C0F2BB3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "C67B5857-3CD8-445A-B60D-C0285BB60A07",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "2949A7DC-2955-4770-94CE-5AB9EEC3B1DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.19:*:*:*:*:*:*:*",
              "matchCriteriaId": "B227D078-8298-4594-8F96-F2976F189B6A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors.  NOTE: this issue could also trigger an out-of-bounds read, but it might not trigger a crash."
    },
    {
      "lang": "es",
      "value": "Las funciones serializing/deserializing de qpid::framing::Buffer en Apache Qpid v0.20 y anteriores permite a atacantes remotos provocar una denegaci\u00f3n de servicio (error de aserci\u00f3n y salida del demonio) a trav\u00e9s de vectores no especificados. NOTA: este problema tambi\u00e9n podr\u00eda provocar un error de salida de l\u00edmites al leer, pero no podr\u00edan dar lugar a una ca\u00edda."
    }
  ],
  "id": "CVE-2012-4460",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2013-03-14T03:10:23.407",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1453031"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=861242"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://issues.apache.org/jira/browse/QPID-4629"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%20%220.21%22%20AND%20project%20%3D%20QPID"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1453031"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=861242"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://issues.apache.org/jira/browse/QPID-4629"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%20%220.21%22%20AND%20project%20%3D%20QPID"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.