Bug 1093527 (CVE-2014-0110) - CVE-2014-0110 Apache CXF: Large invalid content could cause temporary space to fill
Summary: CVE-2014-0110 Apache CXF: Large invalid content could cause temporary space t...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-0110
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1095550 1095551 1095552 1095553 1095554 1095555 1095556 1095557 1166933 1166934 1166944 1167713
Blocks: 1059445 1082938 1093531 1108493 1210482
TreeView+ depends on / blocked
 
Reported: 2014-05-02 01:41 UTC by Arun Babu Neelicattu
Modified: 2019-09-29 13:16 UTC (History)
52 users (show)

Fixed In Version: cxf 2.6.14, cxf 2.7.11
Doc Type: Bug Fix
Doc Text:
It was found that when a large invalid SOAP message was processed by Apache CXF, it could be saved to a temporary file in the /tmp directory. A remote attacker could send a specially crafted SOAP message that, when processed by an application using Apache CXF, would use an excessive amount of disk space, possibly causing a denial of service.
Clone Of:
Environment:
Last Closed: 2016-07-08 22:27:13 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:0797 0 normal SHIPPED_LIVE Moderate: Red Hat JBoss Enterprise Application Platform 6.2.4 update 2014-06-26 19:00:47 UTC
Red Hat Product Errata RHSA-2014:0798 0 normal SHIPPED_LIVE Moderate: Red Hat JBoss Enterprise Application Platform 6.2.4 update 2014-06-26 19:16:02 UTC
Red Hat Product Errata RHSA-2014:0799 0 normal SHIPPED_LIVE Moderate: Red Hat JBoss Enterprise Application Platform 6.2.4 update 2014-06-26 19:11:00 UTC
Red Hat Product Errata RHSA-2014:1351 0 normal SHIPPED_LIVE Important: Red Hat JBoss Fuse/A-MQ 6.1.0 security update 2014-10-01 22:10:39 UTC
Red Hat Product Errata RHSA-2015:0850 0 normal SHIPPED_LIVE Important: Red Hat JBoss BRMS 6.1.0 update 2015-04-16 20:02:45 UTC
Red Hat Product Errata RHSA-2015:0851 0 normal SHIPPED_LIVE Important: Red Hat JBoss BPM Suite 6.1.0 update 2015-04-16 20:02:37 UTC
Red Hat Product Errata RHSA-2015:1009 0 normal SHIPPED_LIVE Important: Red Hat JBoss Portal 6.2.0 update 2015-05-14 19:14:47 UTC

Description Arun Babu Neelicattu 2014-05-02 01:41:26 UTC 
If a SOAP message generates a fault on parsing or processing, but is not 
fully consumed, it is possible to cause the server to read all of the remaining
data and to save it to a temp file. By dynamically creating data, you can
cause the entire /tmp directory to fill.

Affected versions:
Apach CXF 2.6.x < 2.6.14
Apach CXF 2.7.x < 2.7.11

References:
http://cxf.apache.org/security-advisories.data/CVE-2014-0110.txt.asc

Upstream fix:
https://git-wip-us.apache.org/repos/asf?p=cxf.git;a=commit;h=8f4799b5bc5ed0fe62d6e018c45d960e3652373e
Comment 2 Chess Hazlett 2014-05-08 02:01:46 UTC 
Created cxf tracking bugs for this issue:

Affects: fedora-all [bug 1095550]
Comment 5 errata-xmlrpc 2014-06-26 15:01:12 UTC 
This issue has been addressed in following products:

  Red Hat JBoss Enterprise Application Platform 6.2.4

Via RHSA-2014:0797 https://rhn.redhat.com/errata/RHSA-2014-0797.html
Comment 6 errata-xmlrpc 2014-06-26 15:18:09 UTC 
This issue has been addressed in following products:

  JBEAP 6.2 for RHEL 5

Via RHSA-2014:0798 https://rhn.redhat.com/errata/RHSA-2014-0798.html
Comment 7 errata-xmlrpc 2014-06-26 16:18:02 UTC 
This issue has been addressed in following products:

  JBEAP 6.2 for RHEL 6

Via RHSA-2014:0799 https://rhn.redhat.com/errata/RHSA-2014-0799.html
Comment 8 Martin Prpič 2014-09-29 12:01:18 UTC 
IssueDescription:

It was found that when a large invalid SOAP message was processed by Apache CXF, it could be saved to a temporary file in the /tmp directory. A remote attacker could send a specially crafted SOAP message that, when processed by an application using Apache CXF, would use an excessive amount of disk space, possibly causing a denial of service.
Comment 9 errata-xmlrpc 2014-10-01 18:11:04 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Fuse/A-MQ 6.1.0

Via RHSA-2014:1351 https://rhn.redhat.com/errata/RHSA-2014-1351.html
Comment 13 errata-xmlrpc 2015-04-16 16:04:21 UTC 
This issue has been addressed in the following products:

  JBoss BPM Suite 6.1.0

Via RHSA-2015:0851 https://rhn.redhat.com/errata/RHSA-2015-0851.html
Comment 14 errata-xmlrpc 2015-04-16 16:08:55 UTC 
This issue has been addressed in the following products:

  JBoss BRMS 6.1.0

Via RHSA-2015:0850 https://rhn.redhat.com/errata/RHSA-2015-0850.html
Comment 15 errata-xmlrpc 2015-05-14 15:17:55 UTC 
This issue has been addressed in the following products:

  JBoss Portal 6.2.0

Via RHSA-2015:1009 https://rhn.redhat.com/errata/RHSA-2015-1009.html
Note You need to log in before you can comment on or make changes to this bug.