BID:9185

Multiple Vendor XML Parser SOAP Server Denial Of Service Vulnerability

Info

Multiple Vendor XML Parser SOAP Server Denial Of Service Vulnerability

Bugtraq ID:	9185
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 09 2003 12:00AM
Updated:	Dec 09 2003 12:00AM
Credit:	Discovery credited to Amit Klein.
Vulnerable:	Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.0 SP1 Microsoft .NET Framework 1.0 Macromedia JRun 4.0 SP1a Macromedia JRun 4.0 SP1 Macromedia JRun 4.0 build 61650 Macromedia ColdFusion MX J2EE 6.1 Macromedia ColdFusion MX J2EE 6.0 Macromedia ColdFusion MX J2EE 5.0 Macromedia ColdFusion MX 6.1 Macromedia ColdFusion MX 6.0 IBM Websphere Application Server 5.0.2 .1 IBM Websphere Application Server 5.0.2 IBM Websphere Application Server 5.0.1 IBM Websphere Application Server 5.0

Not Vulnerable:

Discussion

Multiple Vendor XML Parser SOAP Server Denial Of Service Vulnerability

A problem has been identified in several different SOAP servers when handling certain types of requests. Because of this, it is possible for an attacker to force a denial of service on systems using a vulnerable implementation.

Exploit / POC

Multiple Vendor XML Parser SOAP Server Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Multiple Vendor XML Parser SOAP Server Denial Of Service Vulnerability

Solution:
Macromedia has released a security bulletin MPSB03-07 with fixes to address this issue in JRun 4.0, ColdFusionMX 6.0, 6.1 J2EE for IBM WebSphere, and ColdFusionMX 6.0, 6.1. Please refer to the advisory for detailed information about obtaining fixes.

Macromedia JRun 4.0 SP1