[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <JPy33wd8NzsoYWV61JbOsQLrJDU@psUvbB26hX94GoQd3C5ThNBxOp8>
Date: Sat, 6 Jun 2009 20:00:20 +0400
From: Eygene Ryabinkin <rea-sec@...elabs.ru>
To: oss-security@...ts.openwall.com,
"Steven M. Christey" <coley@...us.mitre.org>
Cc: coley@...re.org, security@...che.org
Subject: Re: CVE request: "billion laughs" attack against
Apache APR
Good day.
Wed, Jun 03, 2009 at 04:07:43PM +0100, Joe Orton wrote:
> The expat XML parser is vulnerable to the "billion laughs" entity
> expansion attack. This results in a denial of service vulnerability in
> any network-facing service which uses the Apache "APR-util" library's
> wrapper interface for expat to parse untrusted XML documents. The
> Apache httpd WebDAV module "mod_dav" is such a service.
>
> References:
> http://milw0rm.com/exploits/8842
> http://marc.info/?l=apr-dev&m=124396021826125&w=2
> http://svn.apache.org/viewvc?rev=781403&view=rev
>
> Affected versions:
> APR-util <= 1.3.4
Fri, Jun 05, 2009 at 08:21:16PM -0400, Josh Bressers wrote:
> So there's another apr-util flaw. The initial mail makes it sound pretty
> scary, but it's really not that bad.
>
> You can find all the scary details here:
> https://bugzilla.redhat.com/show_bug.cgi?id=504390
Please, note that these two issues and CVE-2009-0023 seem to be
applicable to Apache 2.2.11 and Apache 2.0.63 (latest 2.x versions),
since they have bundled apr-util inside. At least both have the
vulnerable code and I had verified the "billion laughs" attack against
Apache 2.2.11 with Subversion mod_dav_svn that uses internal Apache
libaprutil. OS for testing was FreeBSD, but I think that others are
affected as well.
CC'ing Apache security contacts in case they aren't informed about this
issue yet. Folks, may be I am wrong in my assertions?
--
Eygene
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
