Bug 607118 - (CVE-2010-1632) CVE-2010-1632 Apache Axis2: Does not properly reject DTDs in SOAP messages
CVE-2010-1632 Apache Axis2: Does not properly reject DTDs in SOAP messages
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20090723,repor...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2010-06-23 05:47 EDT by Jan Lieskovsky
Modified: 2013-08-30 14:13 EDT (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-09-23 09:37:37 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2010-06-23 05:47:22 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-1632 to
the following vulnerability:

Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server
(WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9
through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache
Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other
products, does not properly reject DTDs in SOAP messages, which allows
remote attackers to read arbitrary files, send HTTP requests to
intranet servers, or cause a denial of service (CPU and memory
consumption) via a crafted DTD, as demonstrated by an entity
declaration in a request to the Synapse SimpleStockQuoteService.

References:
  [1] http://markmail.org/message/e4yiij7lfexastvl
  [2] http://www-01.ibm.com/support/docview.wss?uid=swg21433581
  [3] https://issues.apache.org/jira/browse/AXIS2-4450
  [4] http://secunia.com/advisories/40252
  [5] http://secunia.com/advisories/40279
  [6] http://www.vupen.com/english/advisories/2010/1528
  [7] http://www.vupen.com/english/advisories/2010/1531
Comment 1 Jan Lieskovsky 2010-06-23 06:04:41 EDT
This issue did NOT affect the versions of the axis package, as shipped
with JBoss Enterprise Application Platform v4.2.0, v4.3.0 or v5.0.0.

This issue did NOT affect the versions of the axis package, as shipped
with JBoss Enterprise Web Server v1.0.1.

This issue did NOT affect the versions of the axis package, as shipped
with Red Hat Network Satellite v5.2.0, v5.2.1, or v5.3.0.

Note You need to log in before you can comment on or make changes to this bug.