Bug 952855 (CVE-2012-4067)

Summary: CVE-2012-4067 eucalyptus: Insecure XML Parsing Vulnerability in Walrus
Product: [Other] Security Response Reporter: Andy Grimm <agrimm>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: djorm
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: impact=moderate,public=20130416,reported=20130416,source=upstream,cvss2=5.0/AV:N/AC:L/Au:N/C:N/I:N/A:P,fedora-all/eucalyptus=affected,jboss/jboss-fuse-6=notaffected,jboss/fuse-esb-enterprise-7=notaffected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-04-17 22:44:04 EDT Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 953354    
Bug Blocks:    

Description Andy Grimm 2013-04-16 17:21:30 EDT
Walrus was not securely parsing XML messages containing Document Type Declarations (DTDs). This flaw could be exploited by a remote unauthenticated
attacker to perform Denial of Service attacks against Walrus.

Links:
http://www.eucalyptus.com/eucalyptus-cloud/security/esa-09
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4067
https://eucalyptus.atlassian.net/browse/EUCA-5277
Comment 1 David Jorm 2013-04-17 22:42:30 EDT
Statement:

Not affected. This flaw does not affect the jclouds Eucalyptus API as shipped with JBoss Fuse 6.0.0 and Fuse ESB Enterprise 7.1.0.
Comment 2 David Jorm 2013-04-17 22:43:31 EDT
Created eucalyptus tracking bugs for this issue

Affects: fedora-all [bug 953354]