Input validation error in Eclipse Mosquitto - CVE-2017-7652
Published: April 25, 2018 / Updated: August 4, 2020
Vulnerability identifier: #VU33762
CSH Severity: Medium
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-7652
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to execute arbitrary code.
In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of clients connected so that there are no more file descriptors/sockets available (default limit typically 1024 file descriptors on Linux), then opening the configuration file will fail.
Affected software
Eclipse Mosquitto
mosquitto (Alpine package)
mosquitto
Fedora
mosquitto (Alpine package)
mosquitto
Fedora
How to mitigate CVE-2017-7652
Install update from vendor's website.
Eclipse Mosquitto - update to 1.4.15
mosquitto (Alpine package) - update to 1.4.15-r0
mosquitto - addressed in versions 1.4.15-1.el7, 1.4.15-1.fc26, 1.4.15-1.fc27, 1.4.15-1.fc28
mosquitto (Alpine package) - update to 1.4.15-r0
mosquitto - addressed in versions 1.4.15-1.el7, 1.4.15-1.fc26, 1.4.15-1.fc27, 1.4.15-1.fc28
External References
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=530102
- https://lists.debian.org/debian-lts-announce/2018/03/msg00037.html
- https://lists.debian.org/debian-lts-announce/2018/06/msg00016.html
- https://mosquitto.org/blog/2018/02/security-advisory-cve-2017-7651-cve-2017-7652/
- https://www.debian.org/security/2018/dsa-4325