PT-2014-2245 · Sblim+2 · Sblim-Cim-Client2+2

Kurt Seifried · Publicado 2012-06-19 · Atualizado 2018-10-30 · CVE-2012-2328

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions sblim-cim-client2 versions prior to 2.1.12

Description The issue allows context-dependent attackers to cause a denial of service, specifically CPU consumption, through a crafted XML file. This is due to the computation of hash values without restricting the ability to trigger hash collisions predictably in the internal/cimxml/sax/NodeFactory.java file.

Recommendations For versions prior to 2.1.12, update to version 2.1.12 or later to resolve the issue.

Correção

DoS

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CESA-2012_0987

CVE-2012-2328

RHSA-2012:0987

RHSA-2012_0987

Produtos afetados

Centos

Red Hat

Sblim-Cim-Client2

Referências · 15

• https://access.redhat.com/security/cve/CVE-2012-2328 · Nota
• https://lists.centos.org/pipermail/centos-announce/2012-July/030763.html · Nota
• https://access.redhat.com/errata/RHSA-2012:0987 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2328 · Nota de Segurança
• https://lists.centos.org/pipermail/centos-announce/2012-July/080887.html · Nota
• https://rhn.redhat.com/errata/RHSA-2012-0987.html · Nota
• https://lists.centos.org/pipermail/centos-announce/2012-July/055644.html · Nota
• http://sourceforge.net/p/sblim/bugs/2381 · Nota
• http://lists.opensuse.org/opensuse-updates/2013-01/msg00038.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2012-0987.html · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-announce/2012-July/068200.html · Nota
• http://sblim.cvs.sourceforge.net/viewvc/sblim/jsr48-client/src/org/sblim/cimclient/internal/cimxml/sax/NodeFactory.java?view=log#rev1.7 · Nota
• https://linux.oracle.com/errata/ELSA-2012-0987.html · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2012-12/msg00015.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-2328 · Nota de Segurança