The soup_headers_parse function in soup-headers.c for libsoup HTTP library before 2.2.99 allows remote attackers to cause a denial of service (crash) via malformed HTTP headers, probably involving missing fields or values.

This update fixes a bug in the HTTP header parsing code of the included libsoup. This bug makes rcd vulnerable to a remote denial-of-service attack. (CVE-2006-5876)

This update fixes a bug in the HTTP header parsing code. Applications using this library maybe vulnerable to a remote denial-of-service attack. (CVE-2006-5876)

Roland Lezuo and Josselin Mouette discovered that the HTTP server code in libsoup did not correctly verify request headers. Remote attackers could crash applications using libsoup by sending a crafted HTTP request, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The soup_headers_parse function in soup-headers.c for libsoup HTTP library before 2.2.99 allows remote attackers to cause a denial of service (crash) via malformed HTTP headers, probably involving missing fields or values.

The updated packages have been patched to correct this issue.

Update to the latest libsoup 2.2 release.

This release fixes a security flaw that causes the libsoup server to crash when it receives a malformed HTTP GET header.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Roland Lezuo and Josselin Mouette discovered that the libsoup HTTP library performs insufficient sanitising when parsing HTTP headers, which might lead to denial of service.

ID	Name	Product	Family	Severity
41119	SuSE9 Security Update : Red Carpet (YOU Patch Number 11461)	Nessus	SuSE Local Security Checks	high
41114	SuSE9 Security Update : libsoup (YOU Patch Number 11401)	Nessus	SuSE Local Security Checks	high
29511	SuSE 10 Security Update : libsoup (ZYPP Patch Number 2501)	Nessus	SuSE Local Security Checks	high
28000	Ubuntu 5.10 / 6.06 LTS / 6.10 : libsoup vulnerability (USN-411-1)	Nessus	Ubuntu Local Security Checks	high
27333	openSUSE 10 Security Update : libsoup (libsoup-2503)	Nessus	SuSE Local Security Checks	high
24642	Mandrake Linux Security Advisory : libsoup (MDKSA-2007:029)	Nessus	Mandriva Local Security Checks	high
24298	Fedora Core 6 : libsoup-2.2.99-1.fc6 (2007-109)	Nessus	Fedora Local Security Checks	high
24025	Debian DSA-1248-1 : libsoup - missing input sanitising	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2006-5876

high

Tenable Plugins

high

high

high

high

high

high

high

high