CVE-2014-9721 Security feature bypass in n/a
Remote attackers can bypass ZMTP v3 security mechanisms by forcing a downgrade to older protocol versions in the libzmq library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-9721?
CVE-2014-9721 is a medium-severity vulnerability in n/a, published on 3 Jun 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.
Weakness: CWE-20
Which versions are affected by CVE-2014-9721?
It affects 1 product.
Linux distribution packages (4)
zeromq SUSE:Enterprise Storage 1.0 | All versions | 4.0.4-13.1 |
zeromq SUSE:Linux Enterprise Desktop 12 | All versions | 4.0.4-13.1 |
zeromq SUSE:Linux Enterprise Software Development Kit 12 | All versions | 4.0.4-13.1 |
zeromq SUSE:Linux Enterprise Workstation Extension 12 | All versions | 4.0.4-13.1 |
Products include Zeromq Zeromq.
How do I fix CVE-2014-9721?
Upgrade to a fixed version.
Is CVE-2014-9721 being exploited?
There is no known exploitation of CVE-2014-9721 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2014-9721, DSA-3255-1, GHSA-cx82-pq93-6p39, SUSE-SU-2015:1510-1, UBUNTU-CVE-2014-9721.