PT-2014-1964 · Libxml2+2 · Libxml2+2
Huzaifa S. Sidhpurwala
·
Publicado
2014-01-21
·
Atualizado
2023-02-13
·
CVE-2013-0339
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
libxml2 versions prior to 2.9.2
Description
The issue is related to the handling of external entities expansion in libxml2, which can be exploited by remote attackers to cause a denial of service, send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document. This is an XML External Entity (XXE) issue. The
xmlSAX2ResolveEntity and xmlSetExternalEntityLoader functions are involved in this issue, and it is noted that the responsibility for resolving this issue may lie with application developers, as libxml2 already provides the ability to disable external entity expansion.Recommendations
For libxml2 versions prior to 2.9.2, consider using the
xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function to properly handle external entities expansion, or disable external entity expansion to minimize the risk of exploitation. As a temporary workaround, consider restricting the use of the xmlSAX2ResolveEntity and xmlSetExternalEntityLoader functions until a patch is available.Exploit
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Suse
Libxml2