Published: 01/10/2013 Updated: 13/02/2023

CVSS v2 Base Score: 6 | Impact Score: 6.4 | Exploitability Score: 6.8

VMScore: 610

Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P

MongoDB prior to 2.0.9 and 2.2.x prior to 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mongodb mongodb 1.8.0
mongodb mongodb 2.0.0
mongodb mongodb 2.0.6
mongodb mongodb 2.2.2
mongodb mongodb 1.2.0
mongodb mongodb 2.2.1
mongodb mongodb 2.2.0
mongodb mongodb 1.4.0
mongodb mongodb 2.0.1
mongodb mongodb 2.0.3
mongodb mongodb
mongodb mongodb 2.0.4
mongodb mongodb 2.2.3
mongodb mongodb 2.0.5
mongodb mongodb 1.6.0
mongodb mongodb 2.0.2
mongodb mongodb 2.0.7
redhat enterprise mrg 2.3

Synopsis Important: mongodb and pymongo security and enhancement update Type/Severity Security Advisory: Important Topic Updated mongodb and pymongo packages that fix two security issues and addone enhancement are now available for Red Hat Enterprise MRG 23 for RedHat Enterprise Linux 6The Red Hat Securit ...

Debian Bug report logs - #704042 CVE-2013-1892 -- mongodb: Remote shell access via run method's use of native_helper Package: mongodb; Maintainer for mongodb is Debian MongoDB Maintainers <team+mongodb@trackerdebianorg>; Source for mongodb is src:mongodb (PTS, buildd, popcon) Reported by: Prach Pongpanich <prachpub@gmai ...

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # web site for more information on licensing and terms of use # metasploitcom/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit: ...

#Title: MongoDB nativeHelperapply Remote Code Execution #Author: agixid blogscrtch/2013/03/24/mongodb-0-day-ssji-to-rce/ #Software Link: fastdlmongodborg/linux/mongodb-linux-i686-223tgz #Version: 223 The following PoC exploits the "nativeHelper" feature in the spidermonkey mongodb implementation the NativeFunction "func" c ...

CWE-20 http://blog.scrt.ch/2013/03/24/mongodb-0-day-ssji-to-rce/http://rhn.redhat.com/errata/RHSA-2013-1170.html http://www.openwall.com/lists/oss-security/2013/03/25/9 https://jira.mongodb.org/browse/SERVER-9124 http://www.mongodb.org/about/alerts/http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101630.html http://www.exploit-db.com/exploits/24947 http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101679.html http://www.exploit-db.com/exploits/24935 https://access.redhat.com/errata/RHSA-2013:1170 https://nvd.nist.gov https://www.exploit-db.com/exploits/24935/

CVE-2013-1892

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect