FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2011-1753

This CVE name corresponds to:

Entered	Topic
2011-06-24	ejabberd -- remote denial of service vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2011-1753 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2011-1753
Phase	Assigned(20110419)

Description

expat_erl.c in ejabberd before 2.1.7 and 3.x before 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

References

Source	Reference
CONFIRM	http://www.ejabberd.im/ejabberd-2.1.7
CONFIRM	http://www.process-one.net/en/ejabberd/release_notes/release_note_ejabberd_2.1.7/
CONFIRM	https://bugzilla.redhat.com/show_bug.cgi?id=700454
CONFIRM	https://git.process-one.net/ejabberd/mainline/commit/bd1df027c622e1f96f9eeaac612a6a956c1ff0b6
DEBIAN	DSA-2248
FEDORA	FEDORA-2011-8415
FEDORA	FEDORA-2011-8437
BID	48072
SECUNIA	44765
SECUNIA	44807
SECUNIA	45120
XF	ejabberd-xml-dos(67769)