CVE-2012-6619

MongoDB < 2.3.2 - Authenticated Denial of Service via Crafted BSON Object

Title source: llm
STIX 2.1

Description

The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service (crash) or read system memory via a crafted BSON object in the column name in an insert command, which triggers a buffer over-read.

References (8)

Core 8
Core References
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/01/07/13
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/01/07/2
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0230.html
Exploit, Vendor Advisory x_refsource_confirm
https://jira.mongodb.org/browse/SERVER-7769
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0440.html
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1049748
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/01/08/9

Scores

EPSS 0.0382
EPSS Percentile 88.8%

Details

CWE
CWE-20
Status published
Products (23)
mongodb/mongodb 1.2.0
mongodb/mongodb 1.4.0
mongodb/mongodb 1.6.0
mongodb/mongodb 1.8.0
mongodb/mongodb 2.0.0
mongodb/mongodb 2.0.1
mongodb/mongodb 2.0.2
mongodb/mongodb 2.0.3
mongodb/mongodb 2.0.4
mongodb/mongodb 2.0.5
... and 13 more
Published Mar 06, 2014
Tracked Since Feb 18, 2026