Bug 607118 (CVE-2010-1632)

Summary:	CVE-2010-1632 Apache Axis2: Does not properly reject DTDs in SOAP messages
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	atangrin, bgeorges, dwalluck, fnasser, mschoene, pcheung, rcvalle
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-09-23 13:37:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2010-06-23 09:47:22 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-1632 to
the following vulnerability:

Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server
(WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9
through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache
Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other
products, does not properly reject DTDs in SOAP messages, which allows
remote attackers to read arbitrary files, send HTTP requests to
intranet servers, or cause a denial of service (CPU and memory
consumption) via a crafted DTD, as demonstrated by an entity
declaration in a request to the Synapse SimpleStockQuoteService.

References:
  [1] http://markmail.org/message/e4yiij7lfexastvl
  [2] http://www-01.ibm.com/support/docview.wss?uid=swg21433581
  [3] https://issues.apache.org/jira/browse/AXIS2-4450
  [4] http://secunia.com/advisories/40252
  [5] http://secunia.com/advisories/40279
  [6] http://www.vupen.com/english/advisories/2010/1528
  [7] http://www.vupen.com/english/advisories/2010/1531

Comment 1 Jan Lieskovsky 2010-06-23 10:04:41 UTC

This issue did NOT affect the versions of the axis package, as shipped
with JBoss Enterprise Application Platform v4.2.0, v4.3.0 or v5.0.0.

This issue did NOT affect the versions of the axis package, as shipped
with JBoss Enterprise Web Server v1.0.1.

This issue did NOT affect the versions of the axis package, as shipped
with Red Hat Network Satellite v5.2.0, v5.2.1, or v5.3.0.