Bug 700454 (CVE-2011-1753)

Summary:	CVE-2011-1753 ejabberd: DoS via the XML "billion laughs attack"
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	lemenkov, satellitgo, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-04-15 15:00:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	734554

Description Jan Lieskovsky 2011-04-28 12:52:42 UTC

ejabberd, when expat is used, do not properly detect recursion
during entity expansion, which allows context-dependent attackers
to cause a denial of service (memory and CPU consumption) via a
crafted XML document containing a large number of nested entity
references, aka the "billion laughs attack." 

References:
[1] http://en.wikipedia.org/wiki/Billion_laughs
[2] http://www.ibm.com/developerworks/xml/library/x-tipcfsx/

Comment 1 Jan Lieskovsky 2011-04-28 12:54:57 UTC

This issue affects the versions of the ejabberd package, as present
within EPEL-5 and EPEL-6 repositories.

This issue affects the versions of the ejabberd package, as shipped
with Fedora release of 13 and 14.

Comment 4 Jan Lieskovsky 2011-04-28 13:09:51 UTC

The CVE identifier of CVE-2011-1753 has been assigned to this issue.

Comment 5 Tomas Hoger 2011-06-03 14:48:13 UTC

Public now via:
  http://www.ejabberd.im/ejabberd-2.1.7

Comment 6 Jan Lieskovsky 2011-06-03 14:53:10 UTC

The fix for this issue has been already included in the following updates:
1) ejabberd-2.1.8-1.el6 for EPEL-6,
2) ejabberd-2.1.8-1.el5 for EPEL-5,
3) ejabberd-2.1.8-1.fc15 for Fedora-15 and finally
4) ejabberd-2.1.8-1.fc14 for Fedora-14.

Comment 7 Peter Lemenkov 2011-06-03 15:03:03 UTC

(In reply to comment #6)
> The fix for this issue has been already included in the following updates:
> 1) ejabberd-2.1.8-1.el6 for EPEL-6,
> 2) ejabberd-2.1.8-1.el5 for EPEL-5,
> 3) ejabberd-2.1.8-1.fc15 for Fedora-15 and finally
> 4) ejabberd-2.1.8-1.fc14 for Fedora-14.

Note - I don't plan to update F-13 (it will be obsoleted very soon so why bother).