Description
The SessionAdapter::ExchangeHandlerImpl::checkAlternate function in broker/SessionAdapter.cpp in the C++ Broker component in Apache Qpid before 0.6, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote authenticated users to cause a denial of service (NULL pointer dereference, daemon crash, and cluster outage) by attempting to modify the alternate of an exchange.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 1 | PyYAML | 3.08-5.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | classads +2 | 1.0.8-1.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | condor +2 | 7.4.4-0.16.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | condor-job-hooks +1 | 1.4-5.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | condor-low-latency | 1.1-0.2.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | condor-vm-gahp | 7.4.4-0.16.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | condor-wallaby +1 | 3.6-6.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | condor-wallaby-base-db | 1.4-5.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | condor-wallaby-tools +1 | 3.6-6.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | cumin | 0.1.4369-1.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | libyaml +1 | 0.1.2-4.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | mrg-grid-docs | 1.3-1.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | mrg-release | 1.3-2.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | python-condorec2e +2 | 1.1-1.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | python-psycopg2 +1 | 2.0.14-2.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | python-qmf | 0.7.946106-13.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | python-qpid | 0.7.946106-14.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | qmf +12 | 0.7.946106-17.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | qpid-java +4 | 0.7.946106-11.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | qpid-tests | 0.7.946106-1.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | rhm-docs | 0.7.946106-8.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | ruby-qmf +3 | 0.7.946106-17.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | ruby-qpid | 0.7.946106-2.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | ruby-rhubarb | 0.2.7-1.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | ruby-sqlite3 | 1.2.4-1.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | saslwrapper +3 | 0.1.934605-2.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | sesame | 0.7.4297-2.el5 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | spqr-gen +1 | 0.3.2-1.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | wallaby +2 | 0.9.18-2.el5 | RHSA-2010:0773 |
Advisories 2
- RHSA-2010:0774 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging and Grid Version 1.3 Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2010:0773 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging and Grid Version 1.3 Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- RHSA-2010:0774 vendor-advisory
- http://svn.apache.org/viewvc?revision=811188&view=revision
- ADV-2010-2684 vdb-entry
- https://issues.apache.org/jira/browse/QPID-2080
- https://bugzilla.redhat.com/show_bug.cgi?id=642377
- 41812 third-party-advisory
- 41710 third-party-advisory
- RHSA-2010:0773 vendor-advisory