SB2024040136 - Multiple vulnerabilities in Microsoft Azure AMQP library for C

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Integer overflow (CVE-ID: CVE-2024-21646)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow. A remote user can pass specially crafted data to the application, trigger an integer overflow and execute arbitrary code on the target system.

2) Use-after-free (CVE-ID: CVE-2024-25110)

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the open_get_offered_capabilities() function. A remote attacker can trigger a use-after-free error and execute arbitrary code on the system.

Remediation

Install update from vendor's website.

References

• https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-j29m-p99g-7hpv
• https://github.com/Azure/azure-uamqp-c/commit/12ddb3a31a5a97f55b06fa5d74c59a1d84ad78fe
• https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-c646-4whf-r67v
• https://github.com/Azure/azure-uamqp-c/commit/30865c9ccedaa32ddb036e87a8ebb52c3f18f695