modules/xmpp/serv_xmpp.c in Citadel 7.86 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

An updated jabberd package that fixes one security issue is now available for Red Hat Network Satellite 5.4.1 for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

This package provides jabberd 2, an Extensible Messaging and Presence Protocol (XMPP) server used for XML based communication.

It was found that the jabberd daemon did not properly detect recursion during entity expansion. A remote attacker could provide a specially crafted XML file containing a large number of nested entity references, which once processed by the jabberd daemon, could lead to a denial of service (excessive memory and CPU consumption).
(CVE-2011-1755)

Red Hat would like to thank Nico Golde of the Debian Security Team for reporting this issue. The Debian Security Team acknowledges Wouter Coekaerts as the original reporter.

Users of Red Hat Network Satellite 5.4.1 are advised to upgrade to this updated jabberd package, which resolves this issue. For this update to take effect, Red Hat Network Satellite must be restarted.
Refer to the Solution section for details.

An updated jabberd package that fixes one security issue is now available for Red Hat Network Proxy 5.4.1 for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

This package provides jabberd 2, an Extensible Messaging and Presence Protocol (XMPP) server used for XML based communication.

It was found that the jabberd daemon did not properly detect recursion during entity expansion. A remote attacker could provide a specially crafted XML file containing a large number of nested entity references, which once processed by the jabberd daemon, could lead to a denial of service (excessive memory and CPU consumption).
(CVE-2011-1755)

Red Hat would like to thank Nico Golde of the Debian Security Team for reporting this issue. The Debian Security Team acknowledges Wouter Coekaerts as the original reporter.

Users of Red Hat Network Proxy 5.4.1 are advised to upgrade to this updated jabberd package, which resolves this issue. For this update to take effect, Red Hat Network Proxy must be restarted. Refer to the Solution section for details.

Wouter Coekaerts discovered that the Jabber server component of Citadel, a complete and feature-rich groupware server, is vulnerable to the so-called'billion laughs' attack because it does not prevent entity expansion on received data. This allows an attacker to perform denial of service attacks against the service by sending specially crafted XML data to it.

ID	Name	Product	Family	Severity
63985	RHEL 5 : jabberd (RHSA-2011:0882)	Nessus	Red Hat Local Security Checks	high
63984	RHEL 5 : jabberd (RHSA-2011:0881)	Nessus	Red Hat Local Security Checks	high
55038	Debian DSA-2250-1 : citadel - denial of service	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2011-1756

high

Tenable Plugins

high

high

medium