Apache Santuario XML Security for C++ CVE-2013-2210 Heap Buffer Overflow Vulnerability

Bugtraq ID:	60817
Class:	Boundary Condition Error
CVE:	CVE-2013-2210
Remote:	Yes
Local:	No
Published:	Jun 27 2013 12:00AM
Updated:	Jun 28 2013 04:00PM
Credit:	Jon Erickson of iSIGHT Partners Labs
Vulnerable:	Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Apache Software Foundation XML Security for C++ 1.6.1 Apache Software Foundation XML Security for C++ 1.6
Not Vulnerable:

Apache Santuario XML Security for C++ CVE-2013-2210 Heap Buffer Overflow Vulnerability

Apache Santuario XML Security for C++ is prone to a remote heap-based buffer-overflow vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits allow remote attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely result in denial-of-service conditions.

Note: This vulnerability exists due to an improper fix of CVE-2013-2154.

Apache Santuario XML Security for C++ versions prior to 1.7.2 are vulnerable.

Apache Santuario XML Security for C++ CVE-2013-2210 Heap Buffer Overflow Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache Santuario XML Security for C++ CVE-2013-2210 Heap Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache Santuario XML Security for C++ CVE-2013-2210 Heap Buffer Overflow Vulnerability

References:

• CVE-2013-2210: Apache Santuario XML Security for C++ contains a heap overflow du (Apache Software Foundation)
  
• XML Security Homepage (Apache Software Foundation)