PT-2011-3682 · Jabberd · Jabberd

Wouter Coekaerts · Publicado 2011-06-22 · Atualizado 2011-06-28 · CVE-2011-2206

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions DJabberd versions prior to 0.85

Description The issue allows remote authenticated users to read arbitrary files and possibly send HTTP requests to intranet servers or cause a denial of service due to CPU and memory consumption. This is achieved via an XML external entity declaration in conjunction with an entity reference.

Recommendations For versions prior to 0.85, update to version 0.85 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2011-2206

Produtos afetados

Jabberd

Referências · 6

• https://github.com/djabberd/DJabberd/commit/b41d6dc247a175fe8e092d6ec2c460826fa62992 · Correção
• http://groups.google.com/group/djabberd/msg/80a462d5c28873d7?dmode=source&output=gplain · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-2206 · Nota de Segurança
• http://openwall.com/lists/oss-security/2011/06/15/5 · Correção
• https://raw.github.com/djabberd/DJabberd/master/CHANGES · Nota
• http://openwall.com/lists/oss-security/2011/06/14/6 · Correção