Bug 607118 (CVE-2010-1632) - CVE-2010-1632 Apache Axis2: Does not properly reject DTDs in SOAP messages
Summary: CVE-2010-1632 Apache Axis2: Does not properly reject DTDs in SOAP messages
Status: CLOSED NOTABUG
Alias: CVE-2010-1632
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20090723,repor...
Keywords: Security
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-06-23 09:47 UTC by Jan Lieskovsky
Modified: 2013-08-30 18:13 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-09-23 13:37:37 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

Description Jan Lieskovsky 2010-06-23 09:47:22 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-1632 to
the following vulnerability:

Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server
(WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9
through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache
Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other
products, does not properly reject DTDs in SOAP messages, which allows
remote attackers to read arbitrary files, send HTTP requests to
intranet servers, or cause a denial of service (CPU and memory
consumption) via a crafted DTD, as demonstrated by an entity
declaration in a request to the Synapse SimpleStockQuoteService.

References:
  [1] http://markmail.org/message/e4yiij7lfexastvl
  [2] http://www-01.ibm.com/support/docview.wss?uid=swg21433581
  [3] https://issues.apache.org/jira/browse/AXIS2-4450
  [4] http://secunia.com/advisories/40252
  [5] http://secunia.com/advisories/40279
  [6] http://www.vupen.com/english/advisories/2010/1528
  [7] http://www.vupen.com/english/advisories/2010/1531

Comment 1 Jan Lieskovsky 2010-06-23 10:04:41 UTC
This issue did NOT affect the versions of the axis package, as shipped
with JBoss Enterprise Application Platform v4.2.0, v4.3.0 or v5.0.0.

This issue did NOT affect the versions of the axis package, as shipped
with JBoss Enterprise Web Server v1.0.1.

This issue did NOT affect the versions of the axis package, as shipped
with Red Hat Network Satellite v5.2.0, v5.2.1, or v5.3.0.


Note You need to log in before you can comment on or make changes to this bug.