A denial of service flaw was found in the way libxml2, a library providing support to read, modify and write XML and HTML files, performed string substitutions when entity values for entity references replacement (--noent option) was requested / enabled during the XML file parsing. A remote attacker could provide a specially-crafted XML file that, when processed would lead to excessive CPU consumption (denial of service).
This issue affects the versions of the libxml2 package, as shipped with Red Hat Enterprise Linux 5 and 6. -- This issue affects the versions of the libxml2 package, as shipped with Fedora release of 17 and 18. -- This issue affects the versions of the libxml package, as shipped with Fedora release of 17 and 18.
Created libxml2 tracking bugs for this issue Affects: fedora-all [bug 912954]
Created libxml tracking bugs for this issue Affects: fedora-all [bug 912955]
This issue has been assigned CVE-2013-0338 as per: http://seclists.org/oss-sec/2013/q1/391
Upstream patch: http://git.gnome.org/browse/libxml2/commit/?id=23f05e0c33987d6605387b300c4be5da2120a7ab
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 Via RHSA-2013:0581 https://rhn.redhat.com/errata/RHSA-2013-0581.html
This CVE was assigned to a variant of the "billion-laughs" attack, a common attack class against XML parser. This type of attack uses entity references that get replaced by a long string, which causes XML parser to use excessive amount of memory and CPU time. The libxml2 previously got fixes to block this type of attack - see CVE-2003-1564 (bug 461107) and CVE-2008-3281 (bug 458086). Those fixes added heuristics that blocked the original attack, which uses a series of entity expansion, with each entity definition using short replacement string. For example, entity 'a' may be defined to expand to two or more entity 'b' references, entity 'b defined to expand to two or more entity 'c' references, etc. A single use of &a; reference in the document leads to expansion with exponential complexity. This variant uses entity definition that expands to a very long string. The XML document needs to contain many references to such entity, which leads to linear complexity, but could still trigger high memory and CPU use. The additional patch adds further checks to block this variant.