expat_erl.c in ejabberd before 2.1.7 and 3.x before 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

An updated jabberd package that fixes one security issue is now available for Red Hat Network Satellite 5.4.1 for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

This package provides jabberd 2, an Extensible Messaging and Presence Protocol (XMPP) server used for XML based communication.

It was found that the jabberd daemon did not properly detect recursion during entity expansion. A remote attacker could provide a specially crafted XML file containing a large number of nested entity references, which once processed by the jabberd daemon, could lead to a denial of service (excessive memory and CPU consumption).
(CVE-2011-1755)

Red Hat would like to thank Nico Golde of the Debian Security Team for reporting this issue. The Debian Security Team acknowledges Wouter Coekaerts as the original reporter.

Users of Red Hat Network Satellite 5.4.1 are advised to upgrade to this updated jabberd package, which resolves this issue. For this update to take effect, Red Hat Network Satellite must be restarted.
Refer to the Solution section for details.

An updated jabberd package that fixes one security issue is now available for Red Hat Network Proxy 5.4.1 for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

This package provides jabberd 2, an Extensible Messaging and Presence Protocol (XMPP) server used for XML based communication.

It was found that the jabberd daemon did not properly detect recursion during entity expansion. A remote attacker could provide a specially crafted XML file containing a large number of nested entity references, which once processed by the jabberd daemon, could lead to a denial of service (excessive memory and CPU consumption).
(CVE-2011-1755)

Red Hat would like to thank Nico Golde of the Debian Security Team for reporting this issue. The Debian Security Team acknowledges Wouter Coekaerts as the original reporter.

Users of Red Hat Network Proxy 5.4.1 are advised to upgrade to this updated jabberd package, which resolves this issue. For this update to take effect, Red Hat Network Proxy must be restarted. Refer to the Solution section for details.

The remote host is affected by the vulnerability described in GLSA-201206-10 (ejabberd: Multiple Denial of Service vulnerabilities)

    Multiple vulnerabilities have been discovered in ejabberd. Please review       the CVE identifiers referenced below for details.
  Impact :

    ejabberd allows remote attackers to cause a Denial of Service condition       with the result of either crashing the daemon or the whole system by       causing memory and CPU consumption.
  Workaround :

    There is no known workaround at this time.

- Fixed issue with ejabberdctl (failed to connect)

    - Ver. 2.1.8

    - Ver. 2.1.8

    - Ver. 2.1.8

    - Ver. 2.1.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It's reported in CVE advisory that :

expat_erl.c in ejabberd before 2.1.7 and 3.x before 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

Wouter Coekaerts discovered that ejabberd, a distributed XMPP/Jabber server written in Erlang, is vulnerable to the so-called 'billion laughs' attack because it does not prevent entity expansion on received data. This allows an attacker to perform denial of service attacks against the service by sending specially crafted XML data to it.

ID	Name	Product	Family	Severity
63985	RHEL 5 : jabberd (RHSA-2011:0882)	Nessus	Red Hat Local Security Checks	high
63984	RHEL 5 : jabberd (RHSA-2011:0881)	Nessus	Red Hat Local Security Checks	high
59648	GLSA-201206-10 : ejabberd: Multiple Denial of Service vulnerabilities	Nessus	Gentoo Local Security Checks	medium
55465	Fedora 14 : ejabberd-2.1.8-2.fc14 (2011-8437)	Nessus	Fedora Local Security Checks	medium
55463	Fedora 15 : ejabberd-2.1.8-2.fc15 (2011-8415)	Nessus	Fedora Local Security Checks	medium
55429	FreeBSD : ejabberd -- remote denial of service vulnerability (01d3ab7d-9c43-11e0-bc0f-0014a5e3cda6)	Nessus	FreeBSD Local Security Checks	medium
55036	Debian DSA-2248-1 : ejabberd - denial of service	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2011-1753

high

Tenable Plugins

high

high

medium

medium

medium

medium

medium