PT-2014-7125 · Zenoss · Zenoss Core

Publicado 2014-12-15 · Atualizado 2016-03-21 · CVE-2014-6259

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Zenoss Core versions through 5 Beta 3

Description The issue allows remote attackers to cause a denial of service due to memory and CPU consumption. This is achieved by sending a crafted XML document that contains a large number of nested entity references, which the software does not properly detect during entity expansion.

Recommendations For Zenoss Core versions through 5 Beta 3, consider restricting the processing of XML documents to prevent excessive entity expansion until a proper fix is available. As a temporary workaround, limiting the size of XML documents or implementing rate limiting on incoming XML requests may help minimize the risk of denial of service attacks.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2014-6259

Produtos afetados

Zenoss Core

Referências · 4

• http://kb.cert.org/vuls/id/449452 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6259 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-6259 · Nota de Segurança
• https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing · Aviso do Fabricante