[arch-security] [Arch Linux Security Advisory ASA-201410-4] zeromq: Man-in-the-middle downgrade and replay attack
levente at leventepolyak.net
Wed Oct 15 09:38:20 UTC 2014
Arch Linux Security Advisory ASA-201410-4
Date : 2014-10-15
CVE-ID : CVE-2014-7202 CVE-2014-7203
Package : zeromq
Type : Man-in-the-middle downgrade and replay attack
Remote : yes
Link : https://wiki.archlinux.org/index.php/CVE-2014
The package zeromq before version 4.0.5-1 is vulnerable to
man-in-the-middle downgrade and replay attacks.
Upgrade to 4.0.5-1.
# pacman -Syu "zeromq>=4.0.5-1"
The problem has been fixed upstream in version 4.0.5.
- CVE-2014-7202 (downgrade attack)
A bug in stream_engine.cpp allows man-in-the-middle attackers to conduct
downgrade attacks via a crafted connection request.
- CVE-2014-7203 (replay attack)
libzmq did not ensure that nonces are unique, which allows
man-in-the-middle attackers to conduct replay attacks via unspecified
A remote attacker is able to perform unauthorized modifications by using
a downgrade attack to target vulnerable protocol versions or by
performing a replay attack of a recorded communication.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the arch-security