Bug 607118 (CVE-2010-1632) - CVE-2010-1632 Apache Axis2: Does not properly reject DTDs in SOAP messages
Summary: CVE-2010-1632 Apache Axis2: Does not properly reject DTDs in SOAP messages
Status: CLOSED NOTABUG
Alias: CVE-2010-1632
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20090723,repor...
Keywords: Security
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-06-23 09:47 UTC by Jan Lieskovsky
Modified: 2019-06-08 13:01 UTC (History)
7 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2010-09-23 13:37:37 UTC


Attachments (Terms of Use)

Description Jan Lieskovsky 2010-06-23 09:47:22 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-1632 to
the following vulnerability:

Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server
(WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9
through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache
Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other
products, does not properly reject DTDs in SOAP messages, which allows
remote attackers to read arbitrary files, send HTTP requests to
intranet servers, or cause a denial of service (CPU and memory
consumption) via a crafted DTD, as demonstrated by an entity
declaration in a request to the Synapse SimpleStockQuoteService.

References:
  [1] http://markmail.org/message/e4yiij7lfexastvl
  [2] http://www-01.ibm.com/support/docview.wss?uid=swg21433581
  [3] https://issues.apache.org/jira/browse/AXIS2-4450
  [4] http://secunia.com/advisories/40252
  [5] http://secunia.com/advisories/40279
  [6] http://www.vupen.com/english/advisories/2010/1528
  [7] http://www.vupen.com/english/advisories/2010/1531

Comment 1 Jan Lieskovsky 2010-06-23 10:04:41 UTC
This issue did NOT affect the versions of the axis package, as shipped
with JBoss Enterprise Application Platform v4.2.0, v4.3.0 or v5.0.0.

This issue did NOT affect the versions of the axis package, as shipped
with JBoss Enterprise Web Server v1.0.1.

This issue did NOT affect the versions of the axis package, as shipped
with Red Hat Network Satellite v5.2.0, v5.2.1, or v5.3.0.


Note You need to log in before you can comment on or make changes to this bug.