PT-2012-1196 · Apache+1 · Apache Xerces2 Java Parser+1
Bradley Parker
·
Publicado
2012-02-03
·
Atualizado
2023-02-13
·
CVE-2012-0881
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Apache Xerces2 Java Parser versions prior to 2.12.0
Description
The issue is related to resource management errors in the XML file analyzer. It can be exploited by a remote attacker using a specially crafted XML message, leading to a denial of service due to CPU consumption. This is achieved by triggering hash table collisions in an XML service.
Recommendations
For versions prior to 2.12.0, update to version 2.12.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the XML service to minimize the risk of exploitation. Avoid using the vulnerable parser until the issue is resolved.
Correção
DoS
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Apache Xerces2 Java Parser
Debian