Stomper Denial of Service via SIGPIPE Termination

Executive Summary

This vulnerability is a Denial of Service (DoS) issue in Stomper 5e2741e. When a broker sends data to a client whose TCP connection is already closed, the server process receives a SIGPIPE signal and crashes, causing a denial of service. Any unauthenticated client can exploit this by closing the socket at specific points to trigger the crash.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unexpected server process terminations (SIGPIPE) when clients close TCP connections abruptly. Check server logs for SIGPIPE signals or process crashes during network communication. Use tools like tcpdump or Wireshark to capture and inspect TCP connection resets or FIN packets sent by clients before expected data transmission completion.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to crash the server by closing a TCP connection at specific times, disrupting service availability. The impact includes service outages, potential loss of data, and degraded performance for legitimate users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a Denial of Service issue in a specific software component (Stomper 5e2741e). Compliance impacts would depend on how the affected system is used in a broader context, not the vulnerability itself.

Useful 0 Not Useful 0

Mitigation Strategies

Implement proper socket handling to ignore SIGPIPE signals on the server process. Ensure the server is configured to handle closed connections gracefully without crashing. Update or patch the Stomper software to a version that addresses this issue.

Useful 0 Not Useful 0