BID:32377

GeSHi XML Parsing Remote Denial Of Service Vulnerability

Info

GeSHi XML Parsing Remote Denial Of Service Vulnerability

Bugtraq ID:	32377
Class:	Design Error
CVE:	CVE-2008-5185
Remote:	Yes
Local:	No
Published:	Nov 20 2008 12:00AM
Updated:	Nov 21 2008 07:13PM
Credit:	Christian Hoffmann
Vulnerable:	GeSHi GeSHi 1.0.7 .3 GeSHi GeSHi 1.0.7 .2 GeSHi GeSHi 1.0.7 .1 GeSHi GeSHi 1.0.7 GeSHi GeSHi 1.0.6 GeSHi GeSHi 1.0.5 GeSHi GeSHi 1.0.4 GeSHi GeSHi 1.0.3 GeSHi GeSHi 1.0.2 GeSHi GeSHi 1.0.1 GeSHi GeSHi 1.0 .0

Not Vulnerable:	GeSHi GeSHi 1.0.8.0

Discussion

GeSHi XML Parsing Remote Denial Of Service Vulnerability

GeSHi is prone to a remote denial-of-service vulnerability.

Remote attackers can exploit this issue to cause the vulnerable application to enter an infinite loop, consuming excessive resources.

This issue affects versions prior to GeSHi 1.0.8.

Exploit / POC

GeSHi XML Parsing Remote Denial Of Service Vulnerability

The following example exploit is available:

<

Solution / Fix

GeSHi XML Parsing Remote Denial Of Service Vulnerability

Solution:
The vendor has released an updated version. Please see the references for more information.

GeSHi GeSHi 1.0 .0