IBM Integration Bus XML4J Parser Entity Expansion Denial of Service Vulnerability
BID:63224
Info
IBM Integration Bus XML4J Parser Entity Expansion Denial of Service Vulnerability
| Bugtraq ID: | 63224 |
| Class: | Design Error |
| CVE: |
CVE-2013-5372 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 17 2013 12:00AM |
| Updated: | Mar 19 2015 08:39AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
SuSE SUSE Linux Enterprise Server 11 SP2 SuSE SUSE Linux Enterprise Server 10 SP3 LTSS S.u.S.E. SUSE CORE 9 for x86 S.u.S.E. CORE 9 Red Hat Enterprise Linux Workstation Supplementary 6 Red Hat Enterprise Linux Supplementary 5 server Red Hat Enterprise Linux Server Supplementary 6 Red Hat Enterprise Linux HPC Node Supplementary 6 Red Hat Enterprise Linux Desktop Supplementary 6 Red Hat Enterprise Linux Desktop Supplementary 5 client IBM WebSphere Process Server 7.0.4 IBM WebSphere Lombardi Edition 7.2.0 IBM Websphere Application Server 8.0 2 IBM Websphere Application Server 7.0 3 IBM Websphere Application Server 7.0 21 IBM Websphere Application Server 7.0 .9 IBM Websphere Application Server 7.0 .8 IBM Websphere Application Server 7.0 .2 IBM Websphere Application Server 7.0 .13 IBM Websphere Application Server 7.0 .12 IBM Websphere Application Server 7.0 .11 IBM Websphere Application Server 6.1 41 IBM Websphere Application Server 6.1 .9 IBM Websphere Application Server 6.1 .8 IBM Websphere Application Server 6.1 .7 IBM Websphere Application Server 6.1 .6 IBM Websphere Application Server 6.1 .5 IBM Websphere Application Server 6.1 .4 IBM Websphere Application Server 6.1 .32 IBM Websphere Application Server 6.1 .3 IBM Websphere Application Server 6.1 .25 IBM Websphere Application Server 6.1 .23 IBM Websphere Application Server 6.1 .22 IBM Websphere Application Server 6.1 .21 IBM Websphere Application Server 6.1 .20 IBM Websphere Application Server 6.1 .2 IBM Websphere Application Server 6.1 .19 IBM Websphere Application Server 6.1 .18 IBM Websphere Application Server 6.1 .17 IBM Websphere Application Server 6.1 .15 IBM Websphere Application Server 6.1 .14 IBM Websphere Application Server 6.1 .13 IBM Websphere Application Server 6.1 .12 IBM Websphere Application Server 6.1 .11 IBM Websphere Application Server 6.1 .10 IBM Websphere Application Server 6.1 .1 IBM Websphere Application Server 8.0.0.4 IBM Websphere Application Server 8.0.0.1 IBM Websphere Application Server 8.0.0.0 IBM Websphere Application Server 8.0 IBM Websphere Application Server 7.0.0.7 IBM Websphere Application Server 7.0.0.6 IBM Websphere Application Server 7.0.0.5 IBM Websphere Application Server 7.0.0.4 IBM Websphere Application Server 7.0.0.23 IBM Websphere Application Server 7.0.0.19 IBM Websphere Application Server 7.0.0.17 IBM Websphere Application Server 7.0.0.15 IBM Websphere Application Server 7.0.0.14 IBM Websphere Application Server 7.0.0.13 IBM Websphere Application Server 7.0.0.1 IBM Websphere Application Server 7.0.0.0 IBM Websphere Application Server 7.0 IBM Websphere Application Server 6.1.0.45 IBM Websphere Application Server 6.1.0.43 IBM Websphere Application Server 6.1.0.39 IBM Websphere Application Server 6.1.0.37 IBM Websphere Application Server 6.1.0.35 IBM Websphere Application Server 6.1.0.34 IBM Websphere Application Server 6.1.0.33 IBM Websphere Application Server 6.1.0.31 IBM Websphere Application Server 6.1.0.29 IBM Websphere Application Server 6.1.0.27 IBM Websphere Application Server 6.1 IBM Web Experience Factory 7.0.1.2 IBM Web Experience Factory 7.0.1 IBM Web Experience Factory 7.0.0.2 IBM Web Experience Factory 7.0 IBM Tivoli Storage Productivity Center 4.2.1.185 IBM Tivoli Storage Productivity Center 4.2.1 Fix Pack 4 IBM Tivoli Storage Productivity Center 4.2.1 IBM Tivoli Netcool/OMNIbus 7.3 IBM Tivoli Business Service Manager 4.2.1 IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 IBM Rational Team Concert 3.0 IBM Rational Team Concert 2.0 IBM OS/400 V6R1M0 IBM Lotus Notes 8.5.3 IBM Lotus Notes 8.5.2 IBM Lotus Notes 8.5.1 IBM Lotus Notes 8.0.2 IBM Lotus Notes 8.5.2.3 IBM Lotus Notes 8.5.2.2 IBM Lotus Notes 8.5.2.1 IBM Lotus Notes 8.5.2.0 IBM Lotus Notes 8.5.2 FP2 IBM Lotus Notes 8.5.1.5 IBM Lotus Notes 8.5.1.4 IBM Lotus Notes 8.5.1.3 IBM Lotus Notes 8.5.1.2 IBM Lotus Notes 8.5.1 FP5 IBM Lotus Notes 8.5.0.1 IBM Lotus Notes 8.5.0.0 IBM Lotus Notes 8.5 IBM Lotus Notes 8.0.2.6 IBM Lotus Notes 8.0.2.5 IBM Lotus Notes 8.0.2.4 IBM Lotus Notes 8.0.2.3 IBM Lotus Notes 8.0.2.2 IBM Lotus Notes 8.0.2.1 IBM Lotus Notes 8.0.2.0 IBM Lotus Notes 8.0.2 FP6 IBM Lotus Notes 8.0 IBM Lotus Domino 8.5.3 IBM Lotus Domino 8.5.2 IBM Lotus Domino 8.5.1 Fix Pack 2 IBM Lotus Domino 8.5.1 IBM Lotus Domino 8.5 IBM Lotus Domino 8.0.2 Fix Pack 5 IBM Lotus Domino 8.0.2 IBM Lotus Domino 8.0.1 IBM Lotus Domino 8.5FP1 IBM Lotus Domino 8.5.3FP1 IBM Lotus Domino 8.5.2 FP4 IBM Lotus Domino 8.5.2 FP3 IBM Lotus Domino 8.5.2 FP3 IBM Lotus Domino 8.5.2 FP2 IBM Lotus Domino 8.5.1FP5 IBM Lotus Domino 8.5.1.1 IBM Lotus Domino 8.5.0.1 IBM Lotus Domino 8.0.2.4 IBM Lotus Domino 8.0.2.3 IBM Lotus Domino 8.0.2.2 IBM Lotus Domino 8.0.2.1 IBM Lotus Domino 8.0.2 FP4 IBM Lotus Domino 8.0 IBM Java SDK 1.4.2 IBM Java SDK 6 IBM InfoSphere Information Server 8.5 IBM InfoSphere Information Server 8.1 IBM IMS 10 IBM FileNet Content Manager 5.1 IBM AIX 7.1 IBM AIX 6.1 IBM AIX 5.3 |
| Not Vulnerable: | |
Exploit / POC
IBM Integration Bus XML4J Parser Entity Expansion Denial of Service Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
IBM Integration Bus XML4J Parser Entity Expansion Denial of Service Vulnerability
References:
References:
- Cognos 8 Business Intelligence 8.4.1 Interim Fix 3 for Security Exposure (IBM)
- Cognos Business Intelligence 10.1 Interim Fixes for Security Exposure (IBM)
- Cognos Business Intelligence 10.2.x Interim Fixes for Security Exposure (IBM)
- IBM Integration Bus HomePage (IBM)
- Security Bulletin: IBM FileNet Business Process Manager 13 IBM Java Quarterly C (IBM)
- WebSphere Partner Gateway Advanced/Enterprise affected Vulnerabilities (IBM)
- BM Rational Engineering Lifecycle Manager can be affected by vulnerabilities in (IBM)
- IBM Cognos Business Intelligence (CVE-2013-3030, CVE-2013-4002, CVE-2013-2407, C (IBM)
- IBM Endpoint Manager for Remote Control Interim Fix 9.0.0-TIV-IEMRC900-IF0003 (IBM)
- IBM Endpoint Manager for Remote Control Interim Fix 9.0.1-TIV-IEMRC901-IF0001 (IBM)
- IBM Integration Bus and IBM WebSphere Message Broker: Multiple security vulnerab (IBM)
- IBM SDK, Java Technology Edition and Buffer Overflow vulnerabilities in IBM DB2 (IBM)
- IBM Smart Analytics System 5600 is affected by multiple vulnerabilities in the I (IBM)
- IBM Systems Director Storage Control is affected by vulnerabilities in IBM Java (IBM)
- IBM Tivoli Composite Application Manager for Transactions Response Time 7.4 Inte (IBM)
- IBM Tivoli Security Policy Manager can be affected by multiple vulnerabilities i (IBM)
- IBM WebSphere Message Broker and IBM Integration Bus Security Vulnerability: XML (IBM)
- IBM WebSphere Message Broker and IBM Integration Bus Security Vulnerability: XML (IBM)
- InfoSphere Streams Applications Using Custom Java Operators May Be Affected (IBM)
- IV53964: SECURITY APAR,MULTIPLE OPENSSL VULNERABILITIES IN IBM ENDPOINT MANAGER (IBM)
- Java Security Vulnerabilitys addressed in IBM Tivoli Netcool OMNIbus (IBM)
- Multiple vulnerabilities in current releases of the IBM SDK, Java Technology Edi (IBM)
- Multiple vulnerabilities in IBM SDK, Java Technology Edition affect IBM InfoSphe (IBM)
- Multiple vulnerabilities in IBM's Java 5 and Java 6 JREs used by Web Experience (IBM)
- Multiple vulnerabilities in usage of IBM Java SDK in IBM Content Analytics with (IBM)
- Security Alert: Tivoli Policy Driven Software Distribution (Oracle CPU October 2 (IBM)
- SECURITY APAR, MULTIPLE JAVA VULNERABILITIES IN IBM ENDPOINT MANAGER FOR REMOTE (IBM)
- Security Bulletin #4: IBM Tivoli System Automation Application Manager 3.2.2, 3. (IBM)
- Security Bulletin #4: IBM Tivoli System Automation for Multiplatforms 3.2.2, 3.2 (IBM)
- Security Bulletin: IBM Enterprise Content Management Widgets and potential Apach (IBM)
- Security Bulletin: IBM Lotus Expeditor fixes for multiple vulnerabilities in IBM (IBM)
- Security Bulletin: IBM Notes & Domino fixes for multiple vulnerabilities (CVE-20 (IBM)
- Security Bulletin: IBM Operational Decision Manager and WebSphere ILOG JRules: (IBM)
- Security Bulletin: IBM Tivoli Composite Application Manager for Transactions aff (IBM)
- Security Bulletin: Information regarding security vulnerability in IBM SDK for J (IBM)
- Security Bulletin: Information regarding security vulnerability in IBM SDK for J (IBM)
- Security Bulletin: Information regarding security vulnerability in IBM SDK for J (IBM)
- Security Bulletin: Information regarding security vulnerability in IBM SDK for J (IBM)
- Security Bulletin: Java Vulnerability in Rational Automation Framework (CVE-2013 (IBM)
- Security Bulletin: Multiple IBM SDK Java Technology Edition, Version 6 security (IBM)
- Security Bulletin: Multiple Java security vulnerabilities addressed in IBM Endpo (IBM)
- Security Bulletin: Multiple OpenSSL vulnerabilities in IBM Endpoint Manager for (IBM)
- Security Bulletin: Multiple security vulnerabilities exist in WebSphere Transfor (IBM)
- Security Bulletin: Multiple vulnerabilities exist in the SOAP Gateway component (IBM)
- Security Bulletin: Multiple vulnerabilities in IBM SPSS Modeler (CVE-2013-6739, (IBM)
- Security Bulletin: Multiple vulnerabilities in IBM WebSphere Real Time (IBM)
- Security Bulletin: Potential security vulnerabilities in RQM, RTC and RRC for th (IBM)
- Security Bulletin: Potential security vulnerabilities with JavaTM SDKs (IBM)
- Security Bulletin: Potential XML parser denial of service attack affecting all C (IBM)
- Security Bulletin: Security Vulnerabilities for IBM Java on AIX (IBM)
- Security Bulletin: TADDM - Java Quarterly CPU - October 2013 (IBM)
- Security Bulletin: Tivoli Storage Productivity Center - Oracle CPU October 2013 (IBM)
- Security Bulletin: TSM Admin Center Java vulnerabilities (IBM)
- Security Bulletin: Vulnerabilities in IBM FileNet Content Manager due to securit (IBM)
- Security Bulletin: WebSphere Application Server - Oracle CPU October 2013 (IBM)
- Security Bulletin:Tivoli Multiple vulnerabilities in Netcool/Impact (CVE-2013-58 (IBM)
- Security Bulletin:Tivoli Multiple vulnerabilities in Tivoli Business Service Man (IBM)
- SI51086 - JVA-RUN JDK60-32 IBM Technology for Java SR 15 (IBM)
- SI51087 - JVA-RUN JDK60-64 IBM Technology for Java SR 15 (IBM)
- Tivoli Netcool/Webtop can be affected by multiple vulnerabilities in current IBM (IBM)
- Tivoli Provisioning Manager, Interim Fix 7.1.1-TIV-TPM-IF00009 (IBM)