PT-2014-6379 · Incutio+2 · Incutio Xml-Rpc Library+2

Publicado 2014-08-18 · Atualizado 2015-11-25 · CVE-2014-5266

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Incutio XML-RPC (IXR) Library as used in WordPress versions prior to 3.9.2 Incutio XML-RPC (IXR) Library as used in Drupal versions prior to 6.33 Incutio XML-RPC (IXR) Library as used in Drupal versions prior to 7.31

Description The issue allows remote attackers to cause a denial of service due to CPU consumption by sending a large XML document. This is achieved by exploiting the lack of limitation on the number of elements in an XML document.

Recommendations For WordPress versions prior to 3.9.2, update to version 3.9.2 or later. For Drupal 6.x versions prior to 6.33, update to version 6.33 or later. For Drupal 7.x versions prior to 7.31, update to version 7.31 or later.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2014-5266

DLA-56-1

DSA-2999-1

DSA-3001-1

Produtos afetados

Drupal

Incutio Xml-Rpc Library

Wordpress

Referências · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/wordpress_xmlrpc_dos.rb · Exploit
• http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830 · Nota
• http://debian.org/security/2014/dsa-3001 · Aviso do Fabricante
• http://debian.org/security/2014/dsa-2999 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-5266 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2014-5266 · Aviso do Fabricante
• https://drupal.org/SA-CORE-2014-004 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-5266 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-5266 · Nota de Segurança
• https://ubuntu.com/security/CVE-2014-5266 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-5266 · Aviso do Fabricante
• https://core.trac.wordpress.org/changeset/29404 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-5266 · Aviso do Fabricante
• https://wordpress.org/news/2014/08/wordpress-3-9-2 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5266 · Nota