Full Report
Cisco Talos’ Vulnerability Discovery & Research team recently disclosed five vulnerabilities in Bloomberg Comdb2. Comdb2 is an open source, high-availability database developed by Bloomberg. It supports features such as clustering, transactions, snapshots, and isolation. The implementation of the database utilizes optimistic locking for concurrent operation.The vulnerabilities
Analysis Summary
# Vulnerability: Multiple Denial of Service Vulnerabilities in Bloomberg Comdb2
## CVE Details
- CVE ID: CVE-2025-36520, CVE-2025-35966, CVE-2025-48498, CVE-2025-46354, CVE-2025-36512
- CVSS Score: Not explicitly provided, severity implied as DoS risk. Based on nature, likely Medium to High.
- CWE: Null Pointer Dereference (for first two)
## Affected Systems
- Products: Bloomberg Comdb2
- Versions: Version 8.1
- Configurations: Database instances accessible over TCP.
## Vulnerability Description
Cisco Talos disclosed five vulnerabilities in Bloomberg Comdb2 8.1. Three of these are null pointer dereference issues leading to Denial of Service (DoS):
1. **CVE-2025-36520 & CVE-2025-35966**: Exist within protocol buffer message handling.
2. **CVE-2025-48498**: Exists within the distributed transaction component.
Additionally, two distinct Denial of Service vulnerabilities were found:
3. **CVE-2025-46354**: Exists in the Distributed Transaction Commit/Abort Operation.
4. **CVE-2025-36512**: Exists when handling a distributed transaction heartbeat.
All vulnerabilities can generally be triggered by sending specially crafted network packets or protocol buffer messages to a database instance.
## Exploitation
- Status: Not exploited in the wild (Implied, as Talos disclosed and vendor patched). PoC availability is not explicitly stated but attack vectors suggest simple proof-of-concept feasibility.
- Complexity: Low (Attackers can trigger DoS simply by connecting over TCP and sending crafted messages/packets).
- Attack Vector: Network
## Impact
- Confidentiality: Unknown/Minimal (Primary impact is DoS)
- Integrity: Unknown/Minimal (Primary impact is DoS)
- Availability: High (All vulnerabilities lead to Denial of Service)
## Remediation
### Patches
- The vendor has patched all vulnerabilities, adhering to disclosure timelines. Specific patched versions are not listed in the summary, but users should upgrade to the latest version available after the disclosure date (July 24, 2025).
### Workarounds
- No explicit workarounds are detailed in the provided text. Mitigation strategies are recommended below.
## Detection
- **Indicators of Compromise**: Unanticipated connection termination, database process crashes, or increased error rates following receipt of unusual network traffic or protocol buffers.
- **Detection methods and tools**: Snort coverage is available for detecting exploitation attempts; download the latest rule sets from Snort.org.
## References
- Vendor advisories: Vulnerabilities disclosed by Cisco Talos.
- Relevant links - defanged:
- Vendor Patches/Reports: `http://talosintelligence.com/vulnerability_reports/TALOS-2025-2197`
- Vendor Patches/Reports: `http://talosintelligence.com/vulnerability_reports/TALOS-2025-2201`
- Vendor Patches/Reports: `http://talosintelligence.com/vulnerability_reports/TALOS-2025-2199`
- Vendor Patches/Reports: `http://talosintelligence.com/vulnerability_reports/TALOS-2025-2198`
- Vendor Patches/Reports: `http://talosintelligence.com/vulnerability_reports/TALOS-2025-2200`
- Snort Rules: `http://snort.org/`
- General Advisories: `http://talosintelligence.com/vulnerability_reports`