CVE-2014-3629
Severity
Low
Affected components
Qpid C++ broker
Affected versions
0.30 and earlier
Fixed versions
0.32 and later
Description
Qpidd can be induced to make http requests.
The XML exchange type is an optional, dynamically loaded module for qpidd that allows creation of exchanges that route messages based on evaluating an xquery expression against them.
On parsing a message sent to an XML exchange, whose body is XML containing a link to a DTD, the broker process will attempt to retrieve the referenced resource(s). I.e. the broker process may be induced to make outgoing HTTP connections by publishing a message containing links to an XML exchange.
Resolution
A patch is available that prevents any retrieval of external entities referenced in the XML. This will be included in subsequent releases, but can be applied to 0.30 if desired.
Mitigation
If the XML exchange functionality is not required, the module in question need not be loaded at all. This can be done either by moving the module - named xml.so - out of the module directory, or by setting the --no-module-dir option and adding an explicit --load-module argument for every required module.
Where the XML exchange functionality is required, authorisation may be enabled to prevent all but trusted users from creating or publishing to xml exchanges.
Credit
This issue was discovered by G. Geshev from MWR Labs.
Apache Qpid, Messaging built on AMQP; Copyright © 2015 The Apache Software Foundation; Licensed under the Apache License, Version 2.0; Apache Qpid, Qpid, Qpid Proton, Proton, Apache, the Apache feather logo, and the Apache Qpid project logo are trademarks of The Apache Software Foundation; All other marks mentioned may be trademarks or registered trademarks of their respective owners