SB2017061384 - Multiple vulnerabilities in Pivotal RabbitMQ

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Cross-site scripting (CVE-ID: CVE-2017-4965)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are vulnerable to XSS attacks.

2) Information disclosure (CVE-ID: CVE-2017-4966)

The vulnerability allows a local authenticated user to execute arbitrary code.

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user credentials in a browser's local storage without expiration, making it possible to retrieve them using a chained attack.

3) Cross-site scripting (CVE-ID: CVE-2017-4967)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are vulnerable to XSS attacks.

Remediation

Install update from vendor's website.

References

• http://www.securityfocus.com/bid/98394
• https://pivotal.io/security/cve-2017-4965
• https://pivotal.io/security/cve-2017-4966