Bug 461107 - (CVE-2003-1564) CVE-2003-1564 libxml2: billion laughs DoS attack
CVE-2003-1564 libxml2: billion laughs DoS attack
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
source=cve,reported=20080902,public=2...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-09-04 04:54 EDT by Tomas Hoger
Modified: 2008-09-11 10:08 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-09-11 10:08:00 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Public test case (1.24 KB, text/plain)
2008-09-04 04:55 EDT, Tomas Hoger
no flags Details

  None (edit)
Description Tomas Hoger 2008-09-04 04:54:37 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2003-1564 to the following vulnerability:

libxml2, possibly before 2.5.0, does not properly detect recursion
during entity expansion, which allows context-dependent attackers to
cause a denial of service (memory and CPU consumption) via a crafted
XML document containing a large number of nested entity references,
aka the "billion laughs attack."

References:
http://www.stylusstudio.com/xmldev/200302/post20020.html
http://www.reddit.com/r/programming/comments/65843/time_to_upgrade_libxml2
http://xmlsoft.org/news.html
http://mail.gnome.org/archives/xml/2008-August/msg00034.html
Comment 1 Tomas Hoger 2008-09-04 04:55:59 EDT
Created attachment 315726 [details]
Public test case

Source: http://www.cogsci.ed.ac.uk/~richard/billion-laughs.xml
Comment 2 Tomas Hoger 2008-09-04 05:02:32 EDT
libxml2 versions as shipped in Red Hat Enterprise Linux 3, 4 and 5 are based on upstream version that detects this this type of attack.  Additionally, detection was further improved recently in the patch for the "attribute value" variant of this attack known as CVE-2008-3281 (see bug #458086 and bug #460396).
Comment 6 Red Hat Product Security 2008-09-11 10:08:00 EDT
This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2008-0886.html

Note You need to log in before you can comment on or make changes to this bug.