Vulnerabilities > CVE-2014-3619 - Resource Management Errors vulnerability in multiple products
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| OS | 1 | |
| Application | 1 |
Common Weakness Enumeration (CWE)
Nessus
NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2015-211.NASL description Updated glusterfs packages fix security vulnerability : glusterfs was vulnerable to a fragment header infinite loop denial of service attack (CVE-2014-3619). Also, the glusterfsd SysV init script was failing to properly start the service. This was fixed by replacing it with systemd unit files for the service that work properly (mga#14049). last seen 2020-06-01 modified 2020-06-02 plugin id 83103 published 2015-04-28 reporter This script is Copyright (C) 2015-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/83103 title Mandriva Linux Security Advisory : glusterfs (MDVSA-2015:211) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Mandriva Linux Security Advisory MDVSA-2015:211. # The text itself is copyright (C) Mandriva S.A. # include("compat.inc"); if (description) { script_id(83103); script_version("2.3"); script_cvs_date("Date: 2019/08/02 13:32:57"); script_cve_id("CVE-2014-3619"); script_xref(name:"MDVSA", value:"2015:211"); script_name(english:"Mandriva Linux Security Advisory : glusterfs (MDVSA-2015:211)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value: "The remote Mandriva Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated glusterfs packages fix security vulnerability : glusterfs was vulnerable to a fragment header infinite loop denial of service attack (CVE-2014-3619). Also, the glusterfsd SysV init script was failing to properly start the service. This was fixed by replacing it with systemd unit files for the service that work properly (mga#14049)." ); script_set_attribute( attribute:"see_also", value:"http://advisories.mageia.org/MGASA-2015-0145.html" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:glusterfs-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:glusterfs-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:glusterfs-geo-replication"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:glusterfs-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64glusterfs-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64glusterfs0"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:business_server:2"); script_set_attribute(attribute:"patch_publication_date", value:"2015/04/27"); script_set_attribute(attribute:"plugin_publication_date", value:"2015/04/28"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2015-2019 Tenable Network Security, Inc."); script_family(english:"Mandriva Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux"); if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu); flag = 0; if (rpm_check(release:"MDK-MBS2", cpu:"x86_64", reference:"glusterfs-client-3.4.1-2.1.mbs2")) flag++; if (rpm_check(release:"MDK-MBS2", cpu:"x86_64", reference:"glusterfs-common-3.4.1-2.1.mbs2")) flag++; if (rpm_check(release:"MDK-MBS2", cpu:"x86_64", reference:"glusterfs-geo-replication-3.4.1-2.1.mbs2")) flag++; if (rpm_check(release:"MDK-MBS2", cpu:"x86_64", reference:"glusterfs-server-3.4.1-2.1.mbs2")) flag++; if (rpm_check(release:"MDK-MBS2", cpu:"x86_64", reference:"lib64glusterfs-devel-3.4.1-2.1.mbs2")) flag++; if (rpm_check(release:"MDK-MBS2", cpu:"x86_64", reference:"lib64glusterfs0-3.4.1-2.1.mbs2")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");NASL family SuSE Local Security Checks NASL id OPENSUSE-2015-219.NASL description glusterfs was updated to fix a fragment header infinite loop denial of service attack (CVE-2014-3619). last seen 2020-06-05 modified 2015-03-12 plugin id 81763 published 2015-03-12 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/81763 title openSUSE Security Update : glusterfs (openSUSE-2015-219) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2015-219. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(81763); script_version("1.3"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2014-3619"); script_name(english:"openSUSE Security Update : glusterfs (openSUSE-2015-219)"); script_summary(english:"Check for the openSUSE-2015-219 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "glusterfs was updated to fix a fragment header infinite loop denial of service attack (CVE-2014-3619)." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=919879" ); script_set_attribute( attribute:"solution", value:"Update the affected glusterfs packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:glusterfs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:glusterfs-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:glusterfs-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:glusterfs-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libgfapi0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libgfapi0-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libgfrpc0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libgfrpc0-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libgfxdr0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libgfxdr0-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libglusterfs0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libglusterfs0-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.1"); script_set_attribute(attribute:"patch_publication_date", value:"2015/03/03"); script_set_attribute(attribute:"plugin_publication_date", value:"2015/03/12"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2015-2020 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE13\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "13.1", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE13.1", reference:"glusterfs-3.4.0~qa9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"glusterfs-debuginfo-3.4.0~qa9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"glusterfs-debugsource-3.4.0~qa9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"glusterfs-devel-3.4.0~qa9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libgfapi0-3.4.0~qa9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libgfapi0-debuginfo-3.4.0~qa9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libgfrpc0-3.4.0~qa9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libgfrpc0-debuginfo-3.4.0~qa9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libgfxdr0-3.4.0~qa9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libgfxdr0-debuginfo-3.4.0~qa9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libglusterfs0-3.4.0~qa9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libglusterfs0-debuginfo-3.4.0~qa9-2.4.1") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "glusterfs / glusterfs-debuginfo / glusterfs-debugsource / etc"); }NASL family SuSE Local Security Checks NASL id OPENSUSE-2015-241.NASL description glusterfs was updated to fix a fragment header infinite loop denial of service attack (CVE-2014-3619). last seen 2020-06-05 modified 2015-03-20 plugin id 81964 published 2015-03-20 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/81964 title openSUSE Security Update : glusterfs (openSUSE-2015-241) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2015-241. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(81964); script_version("1.3"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2014-3619"); script_name(english:"openSUSE Security Update : glusterfs (openSUSE-2015-241)"); script_summary(english:"Check for the openSUSE-2015-241 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "glusterfs was updated to fix a fragment header infinite loop denial of service attack (CVE-2014-3619)." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=919879" ); script_set_attribute( attribute:"solution", value:"Update the affected glusterfs packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:glusterfs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:glusterfs-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:glusterfs-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:glusterfs-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libgfapi0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libgfapi0-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libgfchangelog0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libgfchangelog0-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libgfrpc0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libgfrpc0-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libgfxdr0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libgfxdr0-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libglusterfs0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libglusterfs0-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.2"); script_set_attribute(attribute:"patch_publication_date", value:"2015/03/11"); script_set_attribute(attribute:"plugin_publication_date", value:"2015/03/20"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2015-2020 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE13\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "13.2", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE13.2", reference:"glusterfs-3.5.2-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.2", reference:"glusterfs-debuginfo-3.5.2-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.2", reference:"glusterfs-debugsource-3.5.2-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.2", reference:"glusterfs-devel-3.5.2-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.2", reference:"libgfapi0-3.5.2-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.2", reference:"libgfapi0-debuginfo-3.5.2-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.2", reference:"libgfchangelog0-3.5.2-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.2", reference:"libgfchangelog0-debuginfo-3.5.2-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.2", reference:"libgfrpc0-3.5.2-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.2", reference:"libgfrpc0-debuginfo-3.5.2-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.2", reference:"libgfxdr0-3.5.2-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.2", reference:"libgfxdr0-debuginfo-3.5.2-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.2", reference:"libglusterfs0-3.5.2-2.4.1") ) flag++; if ( rpm_check(release:"SUSE13.2", reference:"libglusterfs0-debuginfo-3.5.2-2.4.1") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "glusterfs / glusterfs-debuginfo / glusterfs-debugsource / etc"); }
Redhat
| rpms |
|
References
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00031.html
- http://review.gluster.org/#/c/8662/4
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00056.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1138145
- http://advisories.mageia.org/MGASA-2015-0145.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:211