CVE-2017-15699

Interconnect: Denial of Service vulnerability in Red Hat JBoss AMQ Interconnect

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A Denial of Service vulnerability was found in Apache Qpid Dispatch Router versions 0.7.0 and 0.8.0. To exploit this vulnerability, a remote user must be able to establish an AMQP connection to the Qpid Dispatch Router and send a specifically crafted AMQP frame which will cause it to segfault and shut down.

Se ha descubierto una vulnerabilidad de denegación de servicio (DoS) en Apache Qpid Dispatch Router 0.7.0 y 0.8.0. Para explotar esta vulnerabilidad, un usuario remoto debe poder establecer una conexión AMQP a Qpid Dispatch Router y enviar un frame AMQP especialmente manipulado, lo que provocará un fallo de segmentación y el cierre.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

None

Integrity

None

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-10-21 CVE Reserved
2018-02-13 CVE Published
2023-12-24 EPSS Updated
2024-09-17 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (4)

URL	Tag	Source
http://www.securityfocus.com/bid/103067	Broken Link

URL	Date	SRC

URL	Date	SRC
https://issues.apache.org/jira/browse/DISPATCH-924	2023-02-09

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2017-15699	2018-02-21
https://bugzilla.redhat.com/show_bug.cgi?id=1512724	2018-02-21

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apache Search vendor "Apache"		Qpid Dispatch Search vendor "Apache" for product "Qpid Dispatch"				0.7.0 Search vendor "Apache" for product "Qpid Dispatch" and version "0.7.0"		-		Affected
Apache Search vendor "Apache"		Qpid Dispatch Search vendor "Apache" for product "Qpid Dispatch"				0.8.0 Search vendor "Apache" for product "Qpid Dispatch" and version "0.8.0"		-		Affected