Bug 1093527 (CVE-2014-0110)

Summary:	CVE-2014-0110 Apache CXF: Large invalid content could cause temporary space to fill
Product:	[Other] Security Response	Reporter:	Arun Babu Neelicattu <aneelica>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, alazarot, anil.saldhana, bdawidow, bleanhar, brms-jira, ccoleman, cdewolf, chazlett, dandread, darran.lofthouse, dmcphers, epp-bugs, etirelli, grocha, gvarsami, hfnukal, jason.greene, jawilson, jcoleman, jdetiber, jialiu, jkeck, jokerman, jpallich, kconner, kseifried, ldimaggi, lgao, lmeyer, lpetrovi, mbaluch, mgoldman, mmccomas, mwinkler, myarboro, nwallace, pavelp, pcheung, pgier, pslavice, rrajasek, rsvoboda, rwagner, rzhang, soa-p-jira, tcunning, theute, tkirby, twalsh, vtunka, weli
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	cxf 2.6.14, cxf 2.7.11	Doc Type:	Bug Fix
Doc Text:	It was found that when a large invalid SOAP message was processed by Apache CXF, it could be saved to a temporary file in the /tmp directory. A remote attacker could send a specially crafted SOAP message that, when processed by an application using Apache CXF, would use an excessive amount of disk space, possibly causing a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-07-08 22:27:13 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1095550, 1095551, 1095552, 1095553, 1095554, 1095555, 1095556, 1095557, 1166933, 1166934, 1166944, 1167713
Bug Blocks:	1059445, 1082938, 1093531, 1108493, 1210482

Description Arun Babu Neelicattu 2014-05-02 01:41:26 UTC

If a SOAP message generates a fault on parsing or processing, but is not 
fully consumed, it is possible to cause the server to read all of the remaining
data and to save it to a temp file. By dynamically creating data, you can
cause the entire /tmp directory to fill.

Affected versions:
Apach CXF 2.6.x < 2.6.14
Apach CXF 2.7.x < 2.7.11

References:
http://cxf.apache.org/security-advisories.data/CVE-2014-0110.txt.asc

Upstream fix:
https://git-wip-us.apache.org/repos/asf?p=cxf.git;a=commit;h=8f4799b5bc5ed0fe62d6e018c45d960e3652373e

Comment 2 Chess Hazlett 2014-05-08 02:01:46 UTC

Created cxf tracking bugs for this issue:

Affects: fedora-all [bug 1095550]

Comment 5 errata-xmlrpc 2014-06-26 15:01:12 UTC

This issue has been addressed in following products:

  Red Hat JBoss Enterprise Application Platform 6.2.4

Via RHSA-2014:0797 https://rhn.redhat.com/errata/RHSA-2014-0797.html

Comment 6 errata-xmlrpc 2014-06-26 15:18:09 UTC

This issue has been addressed in following products:

  JBEAP 6.2 for RHEL 5

Via RHSA-2014:0798 https://rhn.redhat.com/errata/RHSA-2014-0798.html

Comment 7 errata-xmlrpc 2014-06-26 16:18:02 UTC

This issue has been addressed in following products:

  JBEAP 6.2 for RHEL 6

Via RHSA-2014:0799 https://rhn.redhat.com/errata/RHSA-2014-0799.html

Comment 8 Martin Prpič 2014-09-29 12:01:18 UTC

IssueDescription:

It was found that when a large invalid SOAP message was processed by Apache CXF, it could be saved to a temporary file in the /tmp directory. A remote attacker could send a specially crafted SOAP message that, when processed by an application using Apache CXF, would use an excessive amount of disk space, possibly causing a denial of service.

Comment 9 errata-xmlrpc 2014-10-01 18:11:04 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Fuse/A-MQ 6.1.0

Via RHSA-2014:1351 https://rhn.redhat.com/errata/RHSA-2014-1351.html

Comment 13 errata-xmlrpc 2015-04-16 16:04:21 UTC

This issue has been addressed in the following products:

  JBoss BPM Suite 6.1.0

Via RHSA-2015:0851 https://rhn.redhat.com/errata/RHSA-2015-0851.html

Comment 14 errata-xmlrpc 2015-04-16 16:08:55 UTC

This issue has been addressed in the following products:

  JBoss BRMS 6.1.0

Via RHSA-2015:0850 https://rhn.redhat.com/errata/RHSA-2015-0850.html

Comment 15 errata-xmlrpc 2015-05-14 15:17:55 UTC

This issue has been addressed in the following products:

  JBoss Portal 6.2.0

Via RHSA-2015:1009 https://rhn.redhat.com/errata/RHSA-2015-1009.html