Back Linuxsecurity Ubuntu 18.04 LTS MongoDB Major Denial of Service Vulnerability USN-8064
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in MongoDB. Software Description: - mongodb: object/document-oriented database Details: Eliot Horowitz discovered that MongoDB may fail to validate some instances of malformed BSON. A remote attacker could possibly use this issue to cause MongoDB to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-1609) It was discovered that MongoDB read raw permissions from .dbshell history files. A local attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-6494) Travis Brown discovered that MongoDB may be unable to parse specially crafted UTF-8 strings in BSON requests. A remote attacker could possibly use this issue to cause MongoDB to crash, resulting in a denial of service.
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in MongoDB. Software Description: - mongodb: object/document-oriented database Details: Eliot Horowitz discovered that MongoDB may fail to validate some instances of malformed BSON. A remote attacker could possibly use this issue to cause MongoDB to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-1609) It was discovered that MongoDB read raw permissions from .dbshell history files. A local attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-6494) Travis Brown discovered that MongoDB may be unable to parse specially crafted UTF-8 strings in BSON requests. A remote attacker could possibly use this issue to cause MongoDB to crash, resulting in a denial of service.
The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS mongodb 1:3.6.3-0ubuntu1.4+esm1 Available with Ubuntu Pro mongodb-server 1:3.6.3-0ubuntu1.4+esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS mongodb 1:2.6.10-0ubuntu1+esm2 Available with Ubuntu Pro mongodb-server 1:2.6.10-0ubuntu1+esm2 Available with Ubuntu Pro Ubuntu 14.04 LTS mongodb 1:2.4.9-1ubuntu2+esm2 Available with Ubuntu Pro mongodb-server 1:2.4.9-1ubuntu2+esm2 Available with Ubuntu Pro After a standard system update you need to restart MongoDB to make all the necessary changes.
The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS mongodb 1:3.6.3-0ubuntu1.4+esm1 Available with Ubuntu Pro mongodb-server 1:3.6.3-0ubuntu1.4+esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS mongodb 1:2.6.10-0ubuntu1+esm2 Available with Ubuntu Pro mongodb-server 1:2.6.10-0ubuntu1+esm2 Available with Ubuntu Pro Ubuntu 14.04 LTS mongodb 1:2.4.9-1ubuntu2+esm2 Available with Ubuntu Pro mongodb-server 1:2.4.9-1ubuntu2+esm2 Available with Ubuntu Pro After a standard system update you need to restart MongoDB to make all the necessary changes.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
