PT-2011-3682 · Jabberd · Jabberd

Wouter Coekaerts · Published 2011-06-22 · Updated 2011-06-28 · CVE-2011-2206

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions DJabberd versions prior to 0.85

Description The issue allows remote authenticated users to read arbitrary files and possibly send HTTP requests to intranet servers or cause a denial of service due to CPU and memory consumption. This is achieved via an XML external entity declaration in conjunction with an entity reference.

Recommendations For versions prior to 0.85, update to version 0.85 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2011-2206

Affected Products

Jabberd

References · 6

• https://github.com/djabberd/DJabberd/commit/b41d6dc247a175fe8e092d6ec2c460826fa62992 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-2206 · Security Note
• http://openwall.com/lists/oss-security/2011/06/15/5 · Patch
• http://openwall.com/lists/oss-security/2011/06/14/6 · Patch
• http://groups.google.com/group/djabberd/msg/80a462d5c28873d7?dmode=source&output=gplain · Note
• https://raw.github.com/djabberd/DJabberd/master/CHANGES · Note