PT-2017-8644 · Ws-Xmlrpc · Ws-Xmlrpc

0Ang3El · Published 2017-06-06 · Updated 2022-05-17 · CVE-2016-5004

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ws-xmlrpc version 3.1.3

Description The issue allows remote attackers to cause a denial of service by decompressing a large file containing zeroes, exploiting the Content-Encoding HTTP header feature.

Recommendations For ws-xmlrpc version 3.1.3, consider disabling the Content-Encoding HTTP header feature as a temporary workaround until a patch is available. Restrict access to large files to minimize the risk of exploitation.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2016-5004

GHSA-R2PG-W96P-PCPJ

Affected Products

Ws-Xmlrpc

References · 11

• 🔥 https://github.com/0ang3el/unsafe-xmlrpc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-5004 · Security Note
• https://osv.dev/vulnerability/CVE-2016-5004 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r2pg-w96p-pcpj · Vendor Advisory
• https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html · Note
• https://web.archive.org/web/20171114185236/https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html · Note
• https://web.archive.org/web/20160716070844/http://securitytracker.com/id/1036294 · Note
• http://securityfocus.com/bid/91736 · Note
• http://securitytracker.com/id/1036294 · Note
• http://openwall.com/lists/oss-security/2016/07/12/5 · Note
• https://web.archive.org/web/20171111065719/http://securityfocus.com/bid/91736 · Note