Published: 10/12/2018 Updated: 09/10/2019

CVSS v2 Base Score: 3.3 | Impact Score: 2.9 | Exploitability Score: 6.5

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 294

Vector: AV:A/AC:L/Au:N/C:P/I:N/A:N

Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports on any server in the MQ cluster can use this cookie to gain full control over the entire cluster.

Vulnerable Product	Search on Vulmon	Subscribe to Product
pivotal software rabbitmq

Debian Bug report logs - #924768 CVE-2018-1279 Package: rabbitmq-server; Maintainer for rabbitmq-server is Debian OpenStack <team+openstack@trackerdebianorg>; Source for rabbitmq-server is src:rabbitmq-server (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Sun, 17 Mar 2019 11:09:02 UTC ...

RabbitMQ, versions up to and including 379, use an insecure method for generating authentication cookies when configuring clustered operations It is possible to determine the cookie given adequate network topology information Using the default cookie generated by RabbitMQ when forming a RabbitMQ cluster may lead to privileged access if the cook ...

Erlang distribution weaknesses and tooling

Guessing for fun and profit TLDR; Erlang Distribution offers arbitrary code execution, and its access shall have been protected, as explicitely stated by Erlang Sadly, well known daemons expose it, and authentication is based on a guessable seed Pivotal has issued [CVE-2018-1279] for Pivotal RabbitMQ for PCF (nvdnistgov/vuln/detail/CVE-2018-1279) The seductive prope

CWE-330 https://pivotal.io/security/cve-2018-1279 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=924768 https://nvd.nist.gov https://github.com/gteissier/erl-matter https://access.redhat.com/security/cve/cve-2018-1279

CVE-2018-1279

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect