MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request.

The remote host is affected by the vulnerability described in GLSA-201611-13 (MongoDB: Denial of Service)

    MongoDB&rsquo;s &lsquo;mongod&rsquo; server fails to validate some cases of       malformed BSON.
  Impact :

    A remote attacker could send a specially crafted BSON request possibly       resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The version of the remote MongoDB server is 2.4.x prior to 2.4.13 or 2.6.x prior to 2.6.8 or 3.0.x prior to 3.0.0-rc9. It is, therefore, affected by a denial of service vulnerability in mongod due to improper validation of BSON messages. A remote, unauthenticated attacker can exploit this, via a specially crafted BSON message, to cause an uncaught exception, resulting in a denial of service condition.

Security fix for CVE-2015-1609

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upgrade to 2.6.8 - CVE-2015-1609 fix.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
95020	GLSA-201611-13 : MongoDB: Denial of Service	Nessus	Gentoo Local Security Checks	medium
88931	MongoDB 2.4.x < 2.4.13 / 2.6.x < 2.6.8 / 3.0.x < 3.0.0-rc9 mongod BSON DoS	Nessus	Databases	medium
82310	Fedora 21 : mongodb-2.4.13-1.fc21 (2015-4197)	Nessus	Fedora Local Security Checks	medium
81989	Fedora 22 : mongodb-2.6.8-1.fc22 (2015-4003)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2015-1609

high

Tenable Plugins

medium

medium

medium

medium