Detections
Analytics

Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : libxml2 vulnerabilities (USN-644-1)

critical Nessus Plugin ID 37936

Synopsis

The remote Ubuntu host is missing one or more security-related patches.

Description

It was discovered that libxml2 did not correctly handle long entity names. If a user were tricked into processing a specially crafted XML document, a remote attacker could execute arbitrary code with user privileges or cause the application linked against libxml2 to crash, leading to a denial of service. (CVE-2008-3529)

USN-640-1 fixed vulnerabilities in libxml2. When processing extremely large XML documents with valid entities, it was possible to incorrectly trigger the newly added vulnerability protections. This update fixes the problem. (CVE-2008-3281).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected packages.

See Also

https://usn.ubuntu.com/644-1/

Plugin Details

Severity: Critical

ID: 37936

File Name: ubuntu_USN-644-1.nasl

Version: 1.15

Type: local

Agent: unix

Published: 4/23/2009

Updated: 1/19/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:libxml2, p-cpe:/a:canonical:ubuntu_linux:libxml2-dbg, p-cpe:/a:canonical:ubuntu_linux:libxml2-dev, p-cpe:/a:canonical:ubuntu_linux:libxml2-doc, p-cpe:/a:canonical:ubuntu_linux:libxml2-utils, p-cpe:/a:canonical:ubuntu_linux:python-libxml2, p-cpe:/a:canonical:ubuntu_linux:python-libxml2-dbg, p-cpe:/a:canonical:ubuntu_linux:python2.4-libxml2, cpe:/o:canonical:ubuntu_linux:6.06:-:lts, cpe:/o:canonical:ubuntu_linux:7.04, cpe:/o:canonical:ubuntu_linux:7.10, cpe:/o:canonical:ubuntu_linux:8.04:-:lts

Required KB Items: Host/cpu, Host/Debian/dpkg-l, Host/Ubuntu, Host/Ubuntu/release

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/11/2008

Reference Information

CVE: CVE-2008-3281, CVE-2008-3529

BID: 30783

CWE: 119, 399

USN: 644-1