National Cyber Awareness System

Vulnerability Summary for CVE-2011-1753

Overview

expat_erl.c in ejabberd before 2.1.7 and 3.x before 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://git.process-one.net/ejabberd/mainline/commit/bd1df027c622e1f96f9eeaac612a6a956c1ff0b6

Type: Patch Information

Hyperlink:https://git.process-one.net/ejabberd/mainline/commit/bd1df027c622e1f96f9eeaac612a6a956c1ff0b6

External Source: CONFIRM

Name: http://www.ejabberd.im/ejabberd-2.1.7

Type: Patch Information

Hyperlink:http://www.ejabberd.im/ejabberd-2.1.7

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=700454

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=700454

External Source: XF

Name: ejabberd-xml-dos(67769)

Hyperlink:http://xforce.iss.net/xforce/xfdb/67769

External Source: BID

Name: 48072

Hyperlink:http://www.securityfocus.com/bid/48072

External Source: CONFIRM

Name: http://www.process-one.net/en/ejabberd/release_notes/release_note_ejabberd_2.1.7/

Hyperlink:http://www.process-one.net/en/ejabberd/release_notes/release_note_ejabberd_2.1.7/

External Source: DEBIAN

Name: DSA-2248

Hyperlink:http://www.debian.org/security/2011/dsa-2248

External Source: SECUNIA

Name: 45120

Hyperlink:http://secunia.com/advisories/45120

External Source: SECUNIA

Name: 44807

Type: Advisory

Hyperlink:http://secunia.com/advisories/44807

External Source: SECUNIA

Name: 44765

Type: Advisory

Hyperlink:http://secunia.com/advisories/44765

External Source: FEDORA

Name: FEDORA-2011-8437

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062145.html

External Source: FEDORA

Name: FEDORA-2011-8415

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062099.html