PT-2017-8644 · Ws-Xmlrpc · Ws-Xmlrpc

0Ang3El · Publicado 2017-06-06 · Atualizado 2022-05-17 · CVE-2016-5004

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ws-xmlrpc version 3.1.3

Description The issue allows remote attackers to cause a denial of service by decompressing a large file containing zeroes, exploiting the Content-Encoding HTTP header feature.

Recommendations For ws-xmlrpc version 3.1.3, consider disabling the Content-Encoding HTTP header feature as a temporary workaround until a patch is available. Restrict access to large files to minimize the risk of exploitation.

Exploit

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2016-5004

GHSA-R2PG-W96P-PCPJ

Produtos afetados

Ws-Xmlrpc

Referências · 11

• 🔥 https://github.com/0ang3el/unsafe-xmlrpc · Exploit
• https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html · Nota
• https://web.archive.org/web/20171114185236/https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-5004 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-5004 · Aviso do Fabricante
• https://web.archive.org/web/20160716070844/http://securitytracker.com/id/1036294 · Nota
• http://securityfocus.com/bid/91736 · Nota
• https://osv.dev/vulnerability/GHSA-r2pg-w96p-pcpj · Aviso do Fabricante
• http://securitytracker.com/id/1036294 · Nota
• http://openwall.com/lists/oss-security/2016/07/12/5 · Nota
• https://web.archive.org/web/20171111065719/http://securityfocus.com/bid/91736 · Nota