CVE-2019-13132
📋 TL;DR
A remote buffer overflow vulnerability in ZeroMQ's libzmq library allows unauthenticated attackers to execute arbitrary code on servers using CURVE encryption. This affects public-facing ZeroMQ applications with CURVE authentication enabled. The vulnerability has a CVSS score of 9.8, indicating critical severity.
💻 Affected Systems
- ZeroMQ libzmq
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Libzmq by Zeromq
Libzmq by Zeromq
Libzmq by Zeromq
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Remote code execution allowing attackers to take control of vulnerable ZeroMQ servers and potentially pivot to other systems.
If Mitigated
Limited impact if servers are not internet-facing and have strict network segmentation, though internal exploitation remains possible.
🎯 Exploit Status
Exploitation requires connecting to a vulnerable ZeroMQ server with CURVE enabled. No authentication is required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libzmq 4.0.9, 4.1.7, or 4.3.2
Vendor Advisory: https://github.com/zeromq/libzmq/issues/3558
Restart Required: Yes
Instructions:
1. Identify affected ZeroMQ installations. 2. Upgrade to libzmq 4.0.9, 4.1.7, or 4.3.2 or later. 3. Restart all ZeroMQ applications and services. 4. Verify the patch is applied correctly.
🔧 Temporary Workarounds
Disable CURVE authentication
allTemporarily disable CURVE encryption/authentication on ZeroMQ sockets if not required for functionality.
Modify ZeroMQ application configuration to use PLAIN or NULL authentication instead of CURVE
Network isolation
linuxRestrict network access to ZeroMQ servers using firewalls or network segmentation.
iptables -A INPUT -p tcp --dport [ZEROMQ_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [ZEROMQ_PORT] -j DROP
🧯 If You Can't Patch
- Disable CURVE authentication on all ZeroMQ sockets and use alternative authentication methods
- Implement strict network controls to limit access to ZeroMQ servers only from trusted sources
🔍 How to Verify
Check if Vulnerable:
Check libzmq version and verify if CURVE authentication is enabled on listening sockets. Use: zeromq library version check and review application configuration.Check Version:
On Linux: dpkg -l | grep libzmq or rpm -qa | grep zeromq; On Windows: Check installed programs or use zmq_version() in application code.Verify Fix Applied:
Confirm libzmq version is 4.0.9, 4.1.7, 4.3.2 or later using: zmq_version() or package manager query.📡 Detection & Monitoring
Log Indicators:
- Unexpected connection attempts to ZeroMQ ports
- Crash logs from ZeroMQ applications
- Stack trace errors indicating buffer overflow
Network Indicators:
- Unusual traffic patterns to ZeroMQ ports from untrusted sources
- Exploit attempt patterns in network traffic
SIEM Query:
source="*zeromq*" OR process="*zmq*" AND (event_type="crash" OR message="*overflow*" OR message="*segfault*")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00033.html
- http://www.openwall.com/lists/oss-security/2019/07/08/6
- http://www.securityfocus.com/bid/109284
- https://fangpenlin.com/posts/2024/04/07/how-i-discovered-a-9-point-8-critical-security-vulnerability-in-zeromq-with-mostly-pure-luck/
- https://github.com/zeromq/libzmq/issues/3558
- https://github.com/zeromq/libzmq/releases
- https://lists.debian.org/debian-lts-announce/2019/07/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVCTNUEOFFZUNJOXFCYCF3C6Y6NDILI3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MK7SJYDJ7MMRRRPCUN3SCSE7YK6ZSHVS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T6HINI24SL7CU6XIJWUOSGTZWEFOOL7X/
- https://news.ycombinator.com/item?id=39970716
- https://seclists.org/bugtraq/2019/Jul/13
- https://security.gentoo.org/glsa/201908-17
- https://usn.ubuntu.com/4050-1/
- https://www.debian.org/security/2019/dsa-4477
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00033.html
- http://www.openwall.com/lists/oss-security/2019/07/08/6
- http://www.securityfocus.com/bid/109284
- https://fangpenlin.com/posts/2024/04/07/how-i-discovered-a-9-point-8-critical-security-vulnerability-in-zeromq-with-mostly-pure-luck/
- https://github.com/zeromq/libzmq/issues/3558
- https://github.com/zeromq/libzmq/releases
- https://lists.debian.org/debian-lts-announce/2019/07/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVCTNUEOFFZUNJOXFCYCF3C6Y6NDILI3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MK7SJYDJ7MMRRRPCUN3SCSE7YK6ZSHVS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T6HINI24SL7CU6XIJWUOSGTZWEFOOL7X/
- https://news.ycombinator.com/item?id=39970716
- https://seclists.org/bugtraq/2019/Jul/13
- https://security.gentoo.org/glsa/201908-17
- https://usn.ubuntu.com/4050-1/
- https://www.debian.org/security/2019/dsa-4477
