mosquitto

Mosquitto crashes using bad version of protocol

Bug #972389 reported by Vicente Ruiz
16
This bug affects 2 people
Affects Status Importance Assigned to Milestone
mosquitto
Fix Released
High
Unassigned
mosquitto 1.0
mosquitto (Ubuntu)
Fix Released
Undecided
Unassigned
Precise
Fix Released
Undecided
Unassigned
Quantal
Fix Released
Undecided
Unassigned

Bug Description

[Impact]
Remote clients can cause the broker to crash, meaning a DoS for other clients. The bug is caused by a double free() so no chance of buffer overrun or other security issue.

[Fix]
Remove the incorrect memory free call.

[Test Case]

[Regression Potential]
This case is now tested for as part of the continuous integration testing of upstream.

[Original Report]
Hi!

I'm developing my own MQTT library and I'm testing with Mosquitto Broker. If I use 0x02 instead of 0x03 as version of protocol, Mosquitto crashes:

1333455622: New connection from 192.168.10.114.
1333455622: Invalid protocol version 2 in CONNECT from 192.168.10.114.
1333455622: Socket read error on client (null), disconnecting.
*** glibc detected *** /usr/local/sbin/mosquitto: malloc(): smallbin double linked list corrupted: 0x018a83f8 ***

See original description
Revision history for this message
Roger Light (roger.light) wrote :

Thanks for the report, I can confirm the bug. It's a trivial fix, but I'm going to write a test for it before I make the commit.

Changed in mosquitto:
importance: Undecided → High
milestone: none → 0.15.1
status: New → In Progress
Revision history for this message
Roger Light (roger.light) wrote :

This was actually committed a while back.

Changed in mosquitto:
milestone: 0.15.1 → 0.16
status: In Progress → Fix Committed
Roger Light (roger.light)
Changed in mosquitto:
milestone: 0.16 → 1.0
Roger Light (roger.light)
Changed in mosquitto:
status: Fix Committed → Fix Released
Bryce Harrington (bryce)
description: updated
Dimitri John Ledkov (xnox)
Changed in mosquitto (Ubuntu Precise):
status: New → Confirmed
Changed in mosquitto (Ubuntu Quantal):
status: New → Confirmed
Roger Light (roger.light)
description: updated
Revision history for this message
Iain Lane (laney) wrote :

Thanks. This appears to be present in Raring too, so I'll apply the Quantal fix there also.

Revision history for this message
Iain Lane (laney) wrote :

Done!

Changed in mosquitto (Ubuntu):
status: Confirmed → Fix Committed
Changed in mosquitto (Ubuntu Precise):
status: Confirmed → In Progress
Changed in mosquitto (Ubuntu Quantal):
status: Confirmed → In Progress
Revision history for this message
Roger Light (roger.light) wrote :

Great, thanks!

Yes, it is the same in Raring but my plan was to fix it by getting a more up to date version included. I've made some changes to the packaging that reduce the differences between Debian and Ubuntu and was leaving it a while before attempting to push it to experimental/directly to Raring in case any problems popped up.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package mosquitto - 0.15-0ubuntu2

---------------
mosquitto (0.15-0ubuntu2) raring; urgency=low

  * Fix server crash on incorrect protocol number. (LP: #972389)
 -- <email address hidden> (Roger A. Light) Thu, 16 Aug 2012 16:30:34 +0100

Changed in mosquitto (Ubuntu):
status: Fix Committed → Fix Released
Revision history for this message
Brian Murray (brian-murray) wrote : Please test proposed package

Hello Vicente, or anyone else affected,

Accepted mosquitto into quantal-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/mosquitto/0.15-0ubuntu1.12.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in mosquitto (Ubuntu Quantal):
status: In Progress → Fix Committed
tags: added: verification-needed
Changed in mosquitto (Ubuntu Precise):
status: In Progress → Fix Committed
Revision history for this message
Brian Murray (brian-murray) wrote :

Hello Vicente, or anyone else affected,

Accepted mosquitto into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/mosquitto/0.15-0ubuntu1.12.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Revision history for this message
Brian Murray (brian-murray) wrote : [mosquitto/precise] verification still needed

The fix for this bug has been awaiting testing feedback in the -proposed repository for precise for more than 90 days. Please test this fix and update the bug appropriately with the results. In the event that the fix for this bug is still not verified 15 days from now, the package will be removed from the -proposed repository.

tags: added: removal-candidate
Revision history for this message
Roger Light (roger.light) wrote :

I tested the fix originally, but then I'm the one who made the fix.

To be honest, this version is so out of date that it's unlikely anybody else will verify the change. It's just a not very nice bug to leave in for anybody who doesn't find their way to the up to date ppa.

Scott Kitterman (kitterman)
tags: added: verification-done
removed: removal-candidate verification-needed
Revision history for this message
Scott Kitterman (kitterman) wrote : Update Released

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package mosquitto - 0.15-0ubuntu1.12.10.1

---------------
mosquitto (0.15-0ubuntu1.12.10.1) quantal; urgency=low

  * Fix server crash on incorrect protocol number. (LP: #972389)
 -- <email address hidden> (Roger A. Light) Thu, 16 Aug 2012 16:30:34 +0100

Changed in mosquitto (Ubuntu Quantal):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package mosquitto - 0.15-0ubuntu1.12.04.1

---------------
mosquitto (0.15-0ubuntu1.12.04.1) precise; urgency=low

  * Fix server crash on incorrect protocol number. (LP: #972389)
 -- <email address hidden> (Roger A. Light) Thu, 16 Aug 2012 16:30:34 +0100

Changed in mosquitto (Ubuntu Precise):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.