DJabberd XML Parsing Denial of Service Vulnerability

Bugtraq ID:	48312
Class:	Input Validation Error
CVE:	CVE-2011-1757
Remote:	Yes
Local:	No
Published:	Jun 16 2011 12:00AM
Updated:	Jun 16 2011 12:00AM
Credit:	Wouter Coekaerts
Vulnerable:	DJabberd DJabberd 0.84
Not Vulnerable:	DJabberd DJabberd 0.85

DJabberd XML Parsing Denial of Service Vulnerability

DJabberd is prone to a denial-of-service vulnerability because it fails to properly handle crafted XML data.

Exploiting this issue allows remote attackers to cause denial-of-service conditions in the context of an application that uses the vulnerable library. Successfully exploiting this issue allows remote attackers to crash affected applications.

Versions prior to DJabberd 0.85 are vulnerable.

DJabberd XML Parsing Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

DJabberd XML Parsing Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.

DJabberd XML Parsing Denial of Service Vulnerability

References:

• Jabber/XMPP DoS and more (wouter coekaerts)
  
• Security Release DJabberd 0.85 (DJabberd)