(Sun Issues Fix) Libxml2 UTF-8 Validation Flaw Lets Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1019195 |
|
SecurityTracker URL: http://securitytracker.com/id/1019195
|
|
CVE Reference:
CVE-2007-6284
(Links to External Site)
|
Updated: Feb 14 2008
|
Original Entry Date: Jan 16 2008
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): prior to 2.6.31
|
Description:
A vulnerability was reported in Libxml2. A remote user can cause denial of service conditions.
A remote user can send specially crafted data to a target application that uses the libxml UTF-8 decoding function to cause the library to enter an infinite loop.
The vulnerability resides in the xmlCurrentChar() function and can be triggered by certain multibyte combinations.
Brad Fitzpatrick of Google reported this vulnerability.
|
Impact:
A remote user can cause the target application to enter an infinite loop and consume excessive CPU resources on the target system.
|
Solution:
Sun has issued the following fixes.
SPARC Platform
* Solaris 9 with patch 114014-18 or later
* Solaris 10 with patch 125731-02 or later
x86 Platform
* Solaris 9 with patch 114015-18 or later
* Solaris 10 with patch 125732-02 or later
The Sun advisory is available at:
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201514-1
|
Vendor URL: www.xmlsoft.org/ (Links to External Site)
|
Cause:
Input validation error, State error
|
Underlying OS:
UNIX (Solaris - SunOS)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 15 Jan 2008 00:45:30 -0500
Subject: Security Vulnerability in the libxml2 Library may Lead to a Denial of Service (DoS)
|
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103201-1
CVE-2007-6284
|
|
