SB2015012707 - Multiple vulnerabilities in Pivotal RabbitMQ

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2014-9650)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions. 

2) Cross-site scripting (CVE-ID: CVE-2014-9649)

Vulnerability allows a remote attacker to perform Cross-site scripting attacks.

An input validation error exists in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 when processing path info to api/, which is not properly handled in an error message. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

Install update from vendor's website.

References

• http://rhn.redhat.com/errata/RHSA-2016-0308.html
• http://www.openwall.com/lists/oss-security/2015/01/21/13
• http://www.rabbitmq.com/release-notes/README-3.4.1.txt
• http://www.securityfocus.com/bid/76091
• https://groups.google.com/forum/#!topic/rabbitmq-users/-3Z2FyGtXhs
• http://www.securityfocus.com/bid/76084