Bug 607118 (CVE-2010-1632)

Summary: CVE-2010-1632 Apache Axis2: Does not properly reject DTDs in SOAP messages
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: atangrin, bgeorges, dwalluck, fnasser, mschoene, pcheung, rcvalle
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-09-23 13:37:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Jan Lieskovsky 2010-06-23 09:47:22 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-1632 to
the following vulnerability:

Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server
(WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9
through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache
Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other
products, does not properly reject DTDs in SOAP messages, which allows
remote attackers to read arbitrary files, send HTTP requests to
intranet servers, or cause a denial of service (CPU and memory
consumption) via a crafted DTD, as demonstrated by an entity
declaration in a request to the Synapse SimpleStockQuoteService.

References:
  [1] http://markmail.org/message/e4yiij7lfexastvl
  [2] http://www-01.ibm.com/support/docview.wss?uid=swg21433581
  [3] https://issues.apache.org/jira/browse/AXIS2-4450
  [4] http://secunia.com/advisories/40252
  [5] http://secunia.com/advisories/40279
  [6] http://www.vupen.com/english/advisories/2010/1528
  [7] http://www.vupen.com/english/advisories/2010/1531

Comment 1 Jan Lieskovsky 2010-06-23 10:04:41 UTC
This issue did NOT affect the versions of the axis package, as shipped
with JBoss Enterprise Application Platform v4.2.0, v4.3.0 or v5.0.0.

This issue did NOT affect the versions of the axis package, as shipped
with JBoss Enterprise Web Server v1.0.1.

This issue did NOT affect the versions of the axis package, as shipped
with Red Hat Network Satellite v5.2.0, v5.2.1, or v5.3.0.