Neon 'ne_xml*' expat XML Parsing Denial of Service Vulnerability

Bugtraq ID:	36080
Class:	Design Error
CVE:	CVE-2009-2473
Remote:	Yes
Local:	No
Published:	Aug 18 2009 12:00AM
Updated:	Apr 13 2015 09:19PM
Credit:	Joe Orton
Vulnerable:	SuSE Linux 9 SuSE Linux 11 SuSE Linux 10.0 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux EUS 5.4.z server Redhat Enterprise Linux ES 4.8.z Redhat Enterprise Linux ES 4 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux AS 4.8.z Redhat Enterprise Linux AS 4 Redhat Enterprise Linux Desktop version 4 Redhat Enterprise Linux 5 Server Pardus Linux 2009 0 Oracle Enterprise Linux 5 Neon Neon 0.28.5 Neon Neon 0.28.3 Neon Neon 0.28.2 Neon Neon 0.28.1 Neon Neon 0.28 Neon Client Library 0.26.3 Neon Client Library 0.26.2 Neon Client Library 0.26.1 Neon Client Library 0.26 Neon Client Library 0.24.6 Neon Client Library 0.24.5 Neon Client Library 0.24.4 Neon Client Library 0.24.3 Neon Client Library 0.24.2 Neon Client Library 0.24.1 Neon Client Library 0.24 Neon Client Library 0.23.8 Neon Client Library 0.23.7 Neon Client Library 0.23.6 Neon Client Library 0.23.5 Neon Client Library 0.23.4 Neon Client Library 0.23.3 Neon Client Library 0.23.2 Neon Client Library 0.23.1 Neon Client Library 0.23 Neon Client Library 0.19.3 - Debian Linux 3.0 sparc - Debian Linux 3.0 s/390 - Debian Linux 3.0 ppc - Debian Linux 3.0 mipsel - Debian Linux 3.0 mips - Debian Linux 3.0 m68k - Debian Linux 3.0 ia-64 - Debian Linux 3.0 ia-32 - Debian Linux 3.0 hppa - Debian Linux 3.0 arm - Debian Linux 3.0 alpha - Debian Linux 3.0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 CentOS CentOS 5 Avaya Voice Portal 5.0 SP2 Avaya Voice Portal 5.0 SP1 Avaya Voice Portal 5.0 Avaya Messaging Storage Server 3.1 Avaya Message Networking 3.1 Avaya Intuity AUDIX LX 2.0 SP2 Avaya Intuity AUDIX LX 2.0 SP1 Avaya Intuity AUDIX LX 2.0 Apple Mac OS X Server 10.6.4 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.6 Apple Mac OS X 10.6.4 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.6
Not Vulnerable:	Neon Neon 0.28.6 Apple Mac OS X Server 10.6.5 Apple Mac OS X 10.6.5

Neon 'ne_xml*' expat XML Parsing Denial of Service Vulnerability

Neon is prone to a vulnerability that may allow attackers to cause an affected application to consume memory, resulting in a denial-of-service condition.

Versions prior to Neon 0.28.6 are vulnerable.

Neon 'ne_xml*' expat XML Parsing Denial of Service Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Neon 'ne_xml*' expat XML Parsing Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


Apple Mac OS X Server 10.6

• Apple MacOSXServUpdCombo10.6.5.dmg
  For Mac OS X Server v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6

• Apple MacOSXUpdCombo10.6.5.dmg
  For Mac OS X v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva lib64neon0.27-0.28.3-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-devel-0.28.3-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-static-devel-0.28.3-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.1

• Mandriva libneon0.27-0.28.3-2.1mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-devel-0.28.3-2.1mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-static-devel-0.28.3-2.1mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.1 x86_64

• Mandriva lib64neon0.27-0.28.3-0.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-devel-0.28.3-0.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-static-devel-0.28.3-0.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.1

• Mandriva libneon0.27-0.28.3-0.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-devel-0.28.3-0.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-static-devel-0.28.3-0.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.1 x86_64

• Mandriva lib64neon0.27-0.28.3-2.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-devel-0.28.3-2.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-static-devel-0.28.3-2.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva lib64neon0.27-0.28.3-1.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-devel-0.28.3-1.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-static-devel-0.28.3-1.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5

• Mandriva libneon0.27-0.28.3-1.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-devel-0.28.3-1.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-static-devel-0.28.3-1.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.0

• Mandriva libneon0.27-0.28.3-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-devel-0.28.3-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-static-devel-0.28.3-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 4.0

• Mandriva libneon0.27-0.28.3-0.2.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-devel-0.28.3-0.2.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-static-devel-0.28.3-0.2.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/

Neon Client Library 0.19.3

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.23

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.23.1

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.23.2

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.23.3

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.23.4

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.23.5

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.23.6

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.23.7

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.23.8

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.24

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.24.1

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.24.2

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.24.3

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.24.4

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.24.5

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.24.6

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.26

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.26.1

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.26.2

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.26.3

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Neon 0.28

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Neon 0.28.1

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Neon 0.28.2

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Neon 0.28.3

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Neon 0.28.5

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Apple Mac OS X Server 10.6.1

• Apple MacOSXServUpdCombo10.6.5.dmg
  For Mac OS X Server v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.1

• Apple MacOSXUpdCombo10.6.5.dmg
  For Mac OS X v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.2

• Apple MacOSXServUpdCombo10.6.5.dmg
  For Mac OS X Server v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.2

• Apple MacOSXUpdCombo10.6.5.dmg
  For Mac OS X v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.3

• Apple MacOSXUpdCombo10.6.5.dmg
  For Mac OS X v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.3

• Apple MacOSXServUpdCombo10.6.5.dmg
  For Mac OS X Server v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.4

• Apple MacOSXUpd10.6.5.dmg
  For Mac OS X v10.6.4
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.4

• Apple MacOSXServerUpd10.6.5.dmg
  For Mac OS X Server v10.6.4
  http://www.apple.com/support/downloads/

MandrakeSoft Corporate Server 4.0 x86_64

• Mandriva lib64neon0.27-0.28.3-0.2.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-devel-0.28.3-0.2.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-static-devel-0.28.3-0.2.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/

Neon 'ne_xml*' expat XML Parsing Denial of Service Vulnerability

References:

• CVE-2009-2473: fix for "billion laughs" attack against expat (Joe Orton)
  
• Neon Homepage (Neon)
  
• neon: release 0.28.6 (SECURITY) (Joe Orton)
  
• ASA-2009-431: neon security update (RHSA-2009-1452) (Avaya)