PT-2014-2245 · Sblim+2 · Sblim-Cim-Client2+2

Kurt Seifried · Published 2012-06-19 · Updated 2018-10-30 · CVE-2012-2328

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions sblim-cim-client2 versions prior to 2.1.12

Description The issue allows context-dependent attackers to cause a denial of service, specifically CPU consumption, through a crafted XML file. This is due to the computation of hash values without restricting the ability to trigger hash collisions predictably in the internal/cimxml/sax/NodeFactory.java file.

Recommendations For versions prior to 2.1.12, update to version 2.1.12 or later to resolve the issue.

Fix

DoS

Weakness Enumeration

CWE-310

Related Identifiers

CESA-2012_0987

CVE-2012-2328

RHSA-2012:0987

RHSA-2012_0987

Affected Products

Centos

Red Hat

Sblim-Cim-Client2

References · 15

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2328 · Security Note
• http://lists.opensuse.org/opensuse-updates/2013-01/msg00038.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0987.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2012-0987.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2012-12/msg00015.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2328 · Security Note
• https://access.redhat.com/security/cve/CVE-2012-2328 · Note
• https://lists.centos.org/pipermail/centos-announce/2012-July/030763.html · Note
• https://access.redhat.com/errata/RHSA-2012:0987 · Note
• https://lists.centos.org/pipermail/centos-announce/2012-July/080887.html · Note
• https://rhn.redhat.com/errata/RHSA-2012-0987.html · Note
• https://lists.centos.org/pipermail/centos-announce/2012-July/055644.html · Note
• http://sourceforge.net/p/sblim/bugs/2381 · Note
• https://lists.centos.org/pipermail/centos-announce/2012-July/068200.html · Note
• http://sblim.cvs.sourceforge.net/viewvc/sblim/jsr48-client/src/org/sblim/cimclient/internal/cimxml/sax/NodeFactory.java?view=log#rev1.7 · Note