CVE-2014-7203
Description
From CVE.org
libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors.
Statement
This issue did not affect the versions of zeromq as shipped with Inktank Ceph Enterprise 1.2 and 1.3.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
Potentially a replay attack, in which an attacker could send the same data twice, could be crafted if nonces are allowed to be reused. This could allow a user to send a message which masquerades as a valid message from a valid user.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
