There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp. The decoder static allocator could have its sized changed, but the buffer would remain the same as it is a static buffer. A remote, unauthenticated attacker who sends a crafted request to the zeromq server could trigger a buffer overflow WRITE of arbitrary data if CURVE/ZAP authentication is not enabled. The greatest impact of this flaw is to application availability, data integrity, and confidentiality.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4920-1 advisory.

    It was discovered that ZeroMQ incorrectly handled certain application metadata. A remote attacker could     use this issue to cause ZeroMQ to crash, or possibly execute arbitrary code. (CVE-2019-13132)

    It was discovered that ZeroMQ mishandled certain network traffic. An unauthenticated attacker could use     this vulnerability to cause a denial-of- service and prevent legitimate clients from communicating with     ZeroMQ. (CVE-2020-15166)

    It was discovered that ZeroMQ did not properly manage memory under certain circumstances. If a user or     automated system were tricked into connecting to one or multiple compromised servers, a remote attacker     could use this issue to cause a denial of service. (CVE-2021-20234)

    It was discovered that ZeroMQ incorrectly handled memory when processing messages with arbitrarily large     sizes under certain circumstances. A remote unauthenticated attacker could use this issue to cause a     ZeroMQ server to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue     only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-20235)

    It was discovered that ZeroMQ did not properly manage memory under certain circumstances. A remote     unauthenticated attacker could use this issue to cause a ZeroMQ server to crash, resulting in a denial of     service. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-20237)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Dell EMC iDRAC9 installed on the remote host is prior to 5.00.10.00. It is, therefore, affected by a vulnerability as referenced in the DSA-2021-177 advisory.

  - There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp. The decoder     static allocator could have its sized changed, but the buffer would remain the same as it is a static     buffer. A remote, unauthenticated attacker who sends a crafted request to the zeromq server could trigger     a buffer overflow WRITE of arbitrary data if CURVE/ZAP authentication is not enabled. The greatest impact     of this flaw is to application availability, data integrity, and confidentiality. (CVE-2021-20235)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the zeromq package has been released.

Two security issues have been detected in zeromq3.

CVE-2021-20234

Memory leak in client induced by malicious server(s) without CURVE/ZAP.

From issue description [1]. When a pipe processes a delimiter and is already not in active state but still has an unfinished message, the message is leaked.

CVE-2021-20235

Heap overflow when receiving malformed ZMTP v1 packets.

From issue description [2]. The static allocator was implemented to shrink its recorded size similarly to the shared allocator. But it does not need to, and it should not, because unlike the shared one the static allocator always uses a static buffer, with a size defined by the ZMQ_IN_BATCH_SIZE socket option (default 8192), so changing the size opens the library to heap overflows. The static allocator is used only with ZMTP v1 peers.

[1] https://github.com/zeromq/libzmq/security/advisories/GHSA-wfr2-29gj-5w 87 [2] https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7h p6

For Debian 9 stretch, these problems have been fixed in version 4.2.1-4+deb9u4.

We recommend that you upgrade your zeromq3 packages.

For the detailed security status of zeromq3 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/zeromq3

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183116	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : ZeroMQ vulnerabilities (USN-4920-1)	Nessus	Ubuntu Local Security Checks	critical
161797	Dell EMC iDRAC9 < 5.00.10.00 (DSA-2021-177)	Nessus	CGI abuses	high
149288	Photon OS 3.0: Zeromq PHSA-2021-3.0-0232	Nessus	PhotonOS Local Security Checks	high
147685	Debian DLA-2588-1 : zeromq3 security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-20235

high

Tenable Plugins

critical

high

high

high