[Bug 1174872] New: rabbitmq-server: insufficient 'X-Forwarded-For' header validation

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1174872

            Bug ID: 1174872
           Summary: rabbitmq-server: insufficient 'X-Forwarded-For' header
                    validation
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: low
          Priority: low
          Assignee: security-response-team(a)redhat.com
          Reporter: mprpic(a)redhat.com
                CC: abaron(a)redhat.com, aortega(a)redhat.com,
                    apevec(a)redhat.com, ayoung(a)redhat.com,
                    chrisw(a)redhat.com, dallan(a)redhat.com,
                    erlang(a)lists.fedoraproject.org, gkotton(a)redhat.com,
                    hubert.plociniczak(a)gmail.com, jeckersb(a)redhat.com,
                    josh(a)fornwall.com, lemenkov(a)gmail.com, lhh(a)redhat.com,
                    lpeer(a)redhat.com, markmc(a)redhat.com,
                    pmyers(a)redhat.com, rbryant(a)redhat.com,
                    rjones(a)redhat.com, s(a)shk.io, sclewis(a)redhat.com,
                    yeylon(a)redhat.com



In RabbitMQ, the 'loopback_users' configuration directive allows to specify a
list of users that are only permitted to connect to the broker via localhost.
It was found that the RabbitMQ's management plug-in did not sufficiently
validate the 'X-Forwarded-For' header when determining the remote address. A
remote attacker able to send a specially crafted 'X-Forwarded-For' header to
RabbitMQ could use this flaw to connect to the broker as if they were a
localhost user. Note that the attacker must know valid user credentials in
order to connect to the broker.

Upstream patches:

http://hg.rabbitmq.com/rabbitmq-management/rev/c3c41177a11a
http://hg.rabbitmq.com/rabbitmq-management/rev/35e916df027d

References:

https://groups.google.com/forum/#!topic/rabbitmq-users/DMkypbSvIyM
http://www.rabbitmq.com/release-notes/README-3.4.0.txt

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1174872] rabbitmq-server: insufficient 'X-Forwarded-For' header validation

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1174872

Martin Prpic <mprpic(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1174874
         Depends On|                            |1174875
         Depends On|                            |1174876



--- Comment #1 from Martin Prpic <mprpic(a)redhat.com&gt; ---

Created rabbitmq-server tracking bugs for this issue:

Affects: fedora-all [bug 1174874]
Affects: epel-all [bug 1174875]
Affects: epel-all [bug 1174876]


Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1174874
[Bug 1174874] rabbitmq-server: insufficient 'X-Forwarded-For' header
validation [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1174875
[Bug 1174875] rabbitmq-server: insufficient 'X-Forwarded-For' header
validation [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1174876
[Bug 1174876] rabbitmq-server: insufficient 'X-Forwarded-For' header
validation [epel-all]
-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1174872] rabbitmq-server: insufficient 'X-Forwarded-For' header validation

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1174872

Martin Prpic <mprpic(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1174877



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1174872] rabbitmq-server: insufficient 'X-Forwarded-For' header validation

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1174872

Martin Prpic <mprpic(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Whiteboard|impact=low,public=20141015, |impact=low,public=20141015,
                   |reported=20141214,source=de |reported=20141214,source=de
                   |bian,cvss2=3.6/AV:N/AC:H/Au |bian,cvss2=3.6/AV:N/AC:H/Au
                   |:S/C:P/I:P/A:N,cwe=CWE-20,f |:S/C:P/I:P/A:N,cwe=CWE-20,f
                   |edora-all/rabbitmq-server=a |edora-all/rabbitmq-server=a
                   |ffected,epel-all/rabbitmq-s |ffected,epel-all/rabbitmq-s
                   |erver=affected,epel-all/rab |erver=affected,openstack-5/
                   |bitmq-server=affected,opens |rabbitmq-server=new,opensta
                   |tack-5/rabbitmq-server=new, |ck-6/rabbitmq-server=new
                   |openstack-6/rabbitmq-server |
                   |=new                        |



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1174872] rabbitmq-server: insufficient 'X-Forwarded-For' header validation

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1174872
Bug 1174872 depends on bug 1174876, which changed state.

Bug 1174876 Summary: rabbitmq-server: insufficient 'X-Forwarded-For' header
validation [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1174876

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |DUPLICATE



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1174872] rabbitmq-server: insufficient 'X-Forwarded-For' header validation

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1174872
Bug 1174872 depends on bug 1174874, which changed state.

Bug 1174874 Summary: rabbitmq-server: insufficient 'X-Forwarded-For' header
validation [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1174874

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |NOTABUG



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1174872] rabbitmq-server: insufficient 'X-Forwarded-For' header validation

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1174872
Bug 1174872 depends on bug 1174875, which changed state.

Bug 1174875 Summary: rabbitmq-server: insufficient 'X-Forwarded-For' header
validation [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1174875

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1174872] rabbitmq-server: insufficient 'X-Forwarded-For' header validation

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1174872



--- Comment #2 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
rabbitmq-server-3.3.5-4.el7 has been pushed to the Fedora EPEL 7 stable
repository.  If problems still persist, please make note of it in this bug
report.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1174872] rabbitmq-server: insufficient 'X-Forwarded-For' header validation

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1174872

Vasyl Kaigorodov <vkaigoro(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Alias|                            |CVE-2014-9494



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1174872] CVE-2014-9494 rabbitmq-server: insufficient 'X-Forwarded-For' header validation

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1174872

Vasyl Kaigorodov <vkaigoro(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|rabbitmq-server:            |CVE-2014-9494
                   |insufficient                |rabbitmq-server:
                   |'X-Forwarded-For' header    |insufficient
                   |validation                  |'X-Forwarded-For' header
                   |                            |validation



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1174872] CVE-2014-9494 rabbitmq-server: insufficient 'X-Forwarded-For' header validation

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1174872

Garth Mollett <gmollett(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |gmollett(a)redhat.com
         Whiteboard|impact=low,public=20141015, |impact=low,public=20141015,
                   |reported=20141214,source=de |reported=20141214,source=de
                   |bian,cvss2=3.6/AV:N/AC:H/Au |bian,cvss2=3.6/AV:N/AC:H/Au
                   |:S/C:P/I:P/A:N,cwe=CWE-20,f |:S/C:P/I:P/A:N,cwe=CWE-20,f
                   |edora-all/rabbitmq-server=a |edora-all/rabbitmq-server=n
                   |ffected,epel-all/rabbitmq-s |otaffected,epel-all/rabbitm
                   |erver=affected,openstack-5/ |q-server=affected,openstack
                   |rabbitmq-server=new,opensta |-5/rabbitmq-server=notaffec
                   |ck-6/rabbitmq-server=new    |ted,openstack-6/rabbitmq-se
                   |                            |rver=defer



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1174872] CVE-2014-9494 rabbitmq-server: insufficient 'X-Forwarded-For' header validation

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1174872

Peter Lemenkov <plemenko(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mprpic(a)redhat.com,
                   |                            |plemenko(a)redhat.com
              Flags|                            |needinfo?(mprpic(a)redhat.com
                   |                            |)



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1174872] CVE-2014-9494 rabbitmq-server: insufficient 'X-Forwarded-For' header validation

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1174872

Martin Prpic <mprpic(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?(mprpic(a)redhat.com |
                   |)                           |



-- 
You are receiving this mail because:
You are on the CC list for the bug.