qpid-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Andrew Stitcher (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (QPID-3772) Qpid broker on Windows allows multiple, simultaneous processes to listen to broker port
Date Fri, 03 May 2013 19:50:15 GMT

    [ https://issues.apache.org/jira/browse/QPID-3772?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13648723#comment-13648723

Andrew Stitcher commented on QPID-3772:

I think this is the solution, not a "first step". 

>From my reading of the windows documentation, SO_REUSEADDR isn't needed on windows anyway,
but SO_EXCLUSIVEADDRUSE is to stop another process from opening your port.
> Qpid broker on Windows allows multiple, simultaneous processes to listen to broker port
> ---------------------------------------------------------------------------------------
>                 Key: QPID-3772
>                 URL: https://issues.apache.org/jira/browse/QPID-3772
>             Project: Qpid
>          Issue Type: Bug
>          Components: C++ Broker
>    Affects Versions: 0.14
>         Environment: Windows broker
>            Reporter: Chuck Rolke
>              Labels: security
>             Fix For: Future
> Socket code on windows allows multiple, simultaneous listening processes on broker port.

>   C:\Windows\system32>netstat -anb
>   TCP               LISTENING
>  [qpidd2.exe]
>   TCP               LISTENING
>  [qpidd.exe]
> This is a security issue as it allows a rogue process to hijack connections directed
to the broker.
> A simple first step is in Socket.cpp to change SO_REUSEADDR to SO_EXCLUSIVEADDRUSE as
described in
> http://msdn.microsoft.com/en-us/library/windows/desktop/cc150667%28v=vs.85%29.aspx

This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira

To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org

View raw message