Cisco Talos Blog: Bloomberg Comdb2 null pointer dereference and denial-of-service vulnerabilities

Jul 24, 2025

—

Source URL: https://blog.talosintelligence.com/bloomberg-comdb2-null-pointer-dereference-and-denial-of-service-vulnerabilities/
Source: Cisco Talos Blog
Title: Bloomberg Comdb2 null pointer dereference and denial-of-service vulnerabilities

Feedly Summary: Cisco Talos’ Vulnerability Discovery & Research team recently disclosed five vulnerabilities in Bloomberg Comdb2. Comdb2 is an open source, high-availability database developed by Bloomberg. It supports features such as clustering, transactions, snapshots, and isolation. The implementation of the database utilizes optimistic locking for concurrent operation.The vulnerabilities

AI Summary and Description: Yes

Summary: Cisco Talos disclosed five vulnerabilities in the Bloomberg Comdb2 open-source database, including several denial-of-service issues related to protocol handling and transaction operations. These vulnerabilities have been patched, and coverage for their exploitation is available through Snort.

Detailed Description: The vulnerabilities found in Bloomberg Comdb2 highlight critical issues that can affect the security of database systems, especially concerning denial-of-service (DoS) attacks. Here’s a detailed breakdown of the key points:

– **Vulnerabilities Identified**:
– **Three Null Pointer Dereference Vulnerabilities**:
– These are found in the protocol buffer message handling:
– **TALOS-2025-2197 (CVE-2025-36520)**
– **TALOS-2025-2201 (CVE-2025-35966)**
– Both can lead to denial of service if an attacker sends a crafted message to a database instance over TCP.

– **One Distributed Transaction Component Vulnerability**:
– **TALOS-2025-2199 (CVE-2025-48498)**:
– This vulnerability can be triggered by specially crafted network packets, resulting in a denial of service.

– **Denial of Service Vulnerabilities**:
– **TALOS-2025-2198 (CVE-2025-46354)**:
– Found during the Distributed Transaction Commit/Abort Operation, it can lead to a DoS through malicious packets.
– **TALOS-2025-2200 (CVE-2025-36512)**:
– Occurs during the handling of a distributed transaction heartbeat and can be triggered by certain crafted messages.

– **Vendor Response**:
– The vulnerabilities have been patched in accordance with Cisco’s third-party vulnerability disclosure policy.

– **Preventive Measures**:
– Snort coverage exists to help detect the exploitation of these vulnerabilities. Users are encouraged to download the latest rule sets from Snort.org.

**Implications for Security Professionals**:
– Understanding these vulnerabilities is crucial for database security measures.
– Regular updates and adherence to patch notes should be prioritized to mitigate the risk of exploitation.
– Implementing robust monitoring solutions like Snort can enhance the detection of attempts to exploit such vulnerabilities in production environments.

In conclusion, this disclosure serves as a critical reminder for organizations using Bloomberg Comdb2 to assess their vulnerability management practices and implement necessary security controls to protect their database environments.

01 1 2 2025 3 4 5 7 a Act actions AI and Arch art as at ated attack attacks availability Bi by C CERN CI CIA Cisco Cisco Talos closed cluster clustering co Col commit control controls coverage critical Current CVE D data database database security de denial Denial of Service detection disclosure DoS e end environment event exp exploit Exploitation feature features for g Gen H handling high Highlight HR http HTTPS implementation implications implications for security in Instance Intel intelligence inter io Iron isolation issue k Key l led Li M man management management practices measures Monitor monitoring monitoring solutions N network no notes NSA o of on one open open-source operation operations opt organization organizations oS OSINT over party Patch per point policy practices pre preventive measures pro product production production environment production environments professionals protocol ps R rag RCE re red regular updates research response Risk risk of exploitation Ro RoT s search sec security security controls security measure security measures security professionals service shot Snap snapshots Snort Snort.org solutions source SSE support system systems T Talos team ted test the third third-party to Tor TP transactions two under up update updates US use user Users V vendor vulnerabilities vulnerability vulnerability disclosure vulnerability disclosure policy vulnerability discovery Vulnerability Management vulnerability management practice vulnerability management practices Wi x z