CVE-2012-2145

qpid-cpp: not closing incomplete connections exhausts file descriptors, leading to DoS

Severity Score

5.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of incomplete connections.

Apache Qpid v0.17 y anteriores no restringe correctamente las conexiones entrantes de clientes, lo que permite a atacantes remotos provocar una denegación de servicio a través de un gran número de conexiones incompletas.

*Credits: N/A

CVSS Scores

NISTv2 5.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2012-04-04 CVE Reserved
2012-09-20 CVE Published
2023-06-16 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-399: Resource Management Errors

CAPEC

References (11)

URL	Tag	Source
http://www.securityfocus.com/bid/55608	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/78730	Vdb Entry
https://issues.apache.org/jira/browse/QPID-2616	X_refsource_misc
https://issues.apache.org/jira/browse/QPID-4021	X_refsource_misc

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://rhn.redhat.com/errata/RHSA-2012-1269.html	2017-08-29
http://rhn.redhat.com/errata/RHSA-2012-1277.html	2017-08-29
http://secunia.com/advisories/50573	2017-08-29
http://secunia.com/advisories/50698	2017-08-29
http://secunia.com/advisories/50699	2017-08-29
https://bugzilla.redhat.com/show_bug.cgi?id=817175	2012-09-19
https://access.redhat.com/security/cve/CVE-2012-2145	2012-09-19

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apache Search vendor "Apache"		Qpid Search vendor "Apache" for product "Qpid"				<= 0.17 Search vendor "Apache" for product "Qpid" and version " <= 0.17"		-		Affected
Apache Search vendor "Apache"		Qpid Search vendor "Apache" for product "Qpid"				0.6 Search vendor "Apache" for product "Qpid" and version "0.6"		-		Affected
Apache Search vendor "Apache"		Qpid Search vendor "Apache" for product "Qpid"				0.7 Search vendor "Apache" for product "Qpid" and version "0.7"		-		Affected
Apache Search vendor "Apache"		Qpid Search vendor "Apache" for product "Qpid"				0.8 Search vendor "Apache" for product "Qpid" and version "0.8"		-		Affected
Apache Search vendor "Apache"		Qpid Search vendor "Apache" for product "Qpid"				0.9 Search vendor "Apache" for product "Qpid" and version "0.9"		-		Affected
Apache Search vendor "Apache"		Qpid Search vendor "Apache" for product "Qpid"				0.10 Search vendor "Apache" for product "Qpid" and version "0.10"		-		Affected
Apache Search vendor "Apache"		Qpid Search vendor "Apache" for product "Qpid"				0.12 Search vendor "Apache" for product "Qpid" and version "0.12"		-		Affected
Apache Search vendor "Apache"		Qpid Search vendor "Apache" for product "Qpid"				0.14 Search vendor "Apache" for product "Qpid" and version "0.14"		-		Affected
Apache Search vendor "Apache"		Qpid Search vendor "Apache" for product "Qpid"				0.16 Search vendor "Apache" for product "Qpid" and version "0.16"		-		Affected