Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5
CVSSv2

CVE-2017-5637

Published: 10/10/2017 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 505
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Subscribe to Zookeeper

Vulnerability Summary

Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache zookeeper 3.5.0

apache zookeeper 3.5.2

apache zookeeper 3.5.1

apache zookeeper 3.4.9

apache zookeeper 3.4.8

apache zookeeper 3.4.7

apache zookeeper 3.4.6

apache zookeeper 3.4.5

apache zookeeper 3.4.4

apache zookeeper 3.4.3

apache zookeeper 3.4.2

apache zookeeper 3.4.1

apache zookeeper 3.4.0

debian debian linux 8.0

Vendor Advisories

Red Hat: Moderate: Red Hat JBoss BPM Suite 6.4.7 security update
Synopsis Moderate: Red Hat JBoss BPM Suite 647 security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat JBoss BPM SuiteRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base sc ...
Red Hat: Moderate: Red Hat JBoss BRMS 6.4.7 security update
Synopsis Moderate: Red Hat JBoss BRMS 647 security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat JBoss BRMSRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which ...
Debian Security Advisories: DSA-3871-1 zookeeper -- security update
It was discovered that Zookeeper, a service for maintaining configuration information, didn't restrict access to the computationally expensive wchp/wchc commands which could result in denial of service by elevated CPU consumption This update disables those two commands by default The new configuration option 4lwcommandswhitelist can be used to ...
Debian CVElist Bug Report Logs: CVE-2018-8012: Apache ZooKeeper Quorum Peer mutual authentication
Debian Bug report logs - #899332 CVE-2018-8012: Apache ZooKeeper Quorum Peer mutual authentication Package: zookeeper; Maintainer for zookeeper is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Source for zookeeper is src:zookeeper (PTS, buildd, popcon) Reported by: Markus Koschany <apo@debianorg ...
Debian CVElist Bug Report Logs: CVE-2017-5637
Debian Bug report logs - #863811 CVE-2017-5637 Package: src:zookeeper; Maintainer for src:zookeeper is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Wed, 31 May 2017 12:48:02 UTC Severity: grave Tags: fixed-upstream, security, upstream ...
Debian CVElist Bug Report Logs: zookeeper: CVE-2019-0201: information disclosure vulnerability
Debian Bug report logs - #929283 zookeeper: CVE-2019-0201: information disclosure vulnerability Package: src:zookeeper; Maintainer for src:zookeeper is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 20 May 2019 20:06:01 UTC Seve ...
Red Hat: CVE-2017-5637
A denial of service vulnerability was discovered in ZooKeeper which allows an attacker to dramatically increase CPU utilization by abusing "wchp/wchc" commands, leading to the server being unable to serve legitimate requests ...

Exploits

Exploit DB: Zookeeper 3.5.2 Client - Denial of Service
#!/usr/bin/python # Exploit Title: Zookeeper Client Denial Of Service (Port 2181) # Date: 2/7/2017 # Exploit Author: Brandon Dennis # Email: bdennis@mailhodgesedu # Software Link: zookeeperapacheorg/releaseshtml#download # Zookeeper Version: 352 # Tested on: Windows 2008 R2, Windows 2012 R2 x64 & x86 # Description: The wchp comma ...

References

CWE-400CWE-306https://issues.apache.org/jira/browse/ZOOKEEPER-2693http://www.securityfocus.com/bid/98814http://www.debian.org/security/2017/dsa-3871https://access.redhat.com/errata/RHSA-2017:3355https://access.redhat.com/errata/RHSA-2017:3354https://access.redhat.com/errata/RHSA-2017:2477https://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com//security-alerts/cpujul2021.htmlhttps://lists.apache.org/thread.html/58170aeb7a681d462b7fa31cae81110cbb749d2dc83c5736a0bb8370%40%3Cdev.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3Ehttps://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3Ehttps://access.redhat.com/errata/RHSA-2017:3355https://nvd.nist.govhttps://www.exploit-db.com/exploits/42294/https://www.debian.org/security/./dsa-3871
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322administrator privilegesCVE-2024-1579hardcodedCVE-2023-20198CVE-2024-33587CVE-2024-33449CVE-2024-4308HTML injection
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook