Уязвимость CVE-2011-1753: Информация

Описание

expat_erl.c in ejabberd before 2.1.7 and 3.x before 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

Важность: MEDIUM (5,0)

URL: https://nvd.nist.gov/vuln/detail/CVE-2011-1753
Опубликовано: 21 июня 2011 г.
Изменено: 17 августа 2017 г.
Идентификатор типа ошибки: CWE-399

Ссылки на рекомендации, решения и инструменты

Ссылка
Ресурс
44807
  • Vendor Advisory
DSA-2248
    http://www.ejabberd.im/ejabberd-2.1.7
    • Patch
    http://www.process-one.net/en/ejabberd/release_notes/release_note_ejabberd_2.1.7/
      https://bugzilla.redhat.com/show_bug.cgi?id=700454
        44765
        • Vendor Advisory
        https://git.process-one.net/ejabberd/mainline/commit/bd1df027c622e1f96f9eeaac612a6a956c1ff0b6
        • Patch
        FEDORA-2011-8415
          45120
            FEDORA-2011-8437
              48072
                ejabberd-xml-dos(67769)

                    1. Конфигурация 1

                      cpe:2.3:a:process-one:ejabberd:3.0.0:alpha1:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:3.0.0:alpha2:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:2.0.5:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:*:*:*:*:*:*:*:*
                      End including
                      2.1.6
                      cpe:2.3:a:process-one:ejabberd:0.9.1:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:2.0.3:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:1.1.1.1:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:1.1.2:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:0.9.8:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:1.1.14:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:2.0.0:rc1:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:2.0.0:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:2.1.2:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:2.1.0:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:1.1.0:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:2.1.5:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:2.1.3:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:2.0.1_2:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:1.1.1:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:2.0.4:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:0.9:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:1.0.0:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:2.1.4:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:2.0.2:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:1.1.3:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:2.1.1:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:1.1.1.0:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:ejabberd:2.0.0:beta1:*:*:*:*:*:*

                      Конфигурация 2

                      cpe:2.3:a:process-one:exmpp:0.9.2:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:exmpp:0.9.3:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:exmpp:0.9.5:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:exmpp:*:*:*:*:*:*:*:*
                      End including
                      0.9.6
                      cpe:2.3:a:process-one:exmpp:0.9.4:*:*:*:*:*:*:*
                      cpe:2.3:a:process-one:exmpp:0.9.1:*:*:*:*:*:*:*
                  VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
                  Версия: v24.5.3
                  Наверх