—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

Liebe Kolleginnen und Kollegen,

soeben erreichte uns nachfolgendes Sun Security Advisory. Wir geben
diese Informationen unveraendert an Sie weiter.

CVE-2008-4226 / CVE-2008-4225 – Schwachstellen in der Bibliothek libxml2
bis Version 2.7.2

In der Bibliothek libxml2 bis zur Version 2.7.2 koennen durch sehr
grosse XML Eingabedateien Fehler ausgeloest werden. Wird eine vom
Angreifer manipulierte XML-Datei mit Hilfe der libxml2 verarbeitet, so
ist es moeglich, dass die Bibliothek in eine Endlosschleife geraet
(Denial of Service). Weiterhin kann ein Integer Overflow ausgeloest
werden, der zum Absturz der Anwendung fuehrt. Eventuell kann der
Angreifer durch geschickte Ausnutzung der Schwachstelle auch beliebige
Befehle mit den Rechten der Anwendung ausfuehren, welche die
Bibliothek zum Verarbeiten von XML-Daten verwendet.

Betroffen sind die folgenden Software Pakete und Plattformen:

Solaris 9
Solaris 10
OpenSolaris

SPARC Plattform
* Solaris 9
* Solaris 10
* OpenSolaris basierend auf den Builds snv_01 bis snv_105

x86 Plattform
* Solaris 9
* Solaris 10
* OpenSolaris basierend auf den Builds snv_01 bis snv_105

Vom Hersteller werden ueberarbeitete Pakete zur Verfuegung gestellt.

Hersteller Advisory:
http://sunsolve.sun.com/search/document.do?assetkey=1-66-251406-1

(c) der deutschen Zusammenfassung bei DFN-CERT Services GmbH; die
Verbreitung, auch auszugsweise, ist nur unter Hinweis auf den Urheber,
DFN-CERT Services GmbH, und nur zu nicht kommerziellen Zwecken
gestattet.

Mit freundlichen Gruessen,
Torsten Voss

– —

Dipl.-Ing.(FH) Torsten Voss (Incident Response Team)

DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-555
Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737
Sachsenstrasse 5, 20097 Hamburg/Germany, CEO: Dr. Klaus-Peter Kossakowski

16. DFN-Workshop Sicherheit in vernetzten Systemen
https://www.dfn-cert.de/ws2009/

Solution Type Sun Alert
Solution 251406 : Security Vulnerabilities in the libxml2 Library
Routines xmlBufferResize() and xmlSAX2Characters() May Lead to
Arbitrary Code Execution or Denial of Service (DoS)
Related Categories

* Home>Content>Sun Alert Criteria Categories>Security
* Home>Content>Sun Alert Release Phase>Workaround

Bug ID
6778313

Product
Solaris 9 Operating System
Solaris 10 Operating System
OpenSolaris

Date of Workaround Release
03-Feb-2009

SA Document Body
Security Vulnerabilities in the libxml2 Library Routines xmlBufferResize() and
xmlSAX2Characters() May Lead to Arbitrary Code Execution or Denial of Service (
DoS)

1. Impact
There are two security vulnerabilities in the libxml2 library (see
libxml2(3)) bundled with Solaris 9 and Solaris 10 which may impact
applications making use of this library. The precise impact will vary
depending on the application.
The first issue is an integer overflow in the xmlBufferResize() libxml2
function (CVE-2008-4225) which may allow a local or remote unprivileged
user who provides a specially crafted XML file to cause a Denial of
Service (DoS) to the application which is using the libxml2 library (or
potentially to the system as a whole as the application may consume
excessive resources).
The second issue is an integer overflow in the xmlSAX2Characters()
libxml2 function (CVE-2008-4226) which may allow a local or remote
unprivileged user who provides a specially crafted XML file to cause an
application crash or an arbitrary code execution with the privileges of
the user running the application.
Additional information regarding these issues is available in the
following documents:
CVE-2008-4225 at
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4225
CVE-2008-4226 at
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4226
2. Contributing Factors
These issues can occur in the following releases:
SPARC Platform
* Solaris 9
* Solaris 10
* OpenSolaris based upon builds snv_01 through snv_105

x86 Platform
* Solaris 9
* Solaris 10
* OpenSolaris based upon builds snv_01 through snv_105

Note: Solaris 8 does not bundle libxml2 and thus no applications
supplied with Solaris 8 use libxml2. However, libxml2 version 2.4.12 is
included on the Solaris 8 OS Software Supplement CD for use with SunVTS
5.1. which is not affected by these issues.
3. Symptoms
If the first issue has been exploited, the application which makes use
of the libxml2 library to process the crafted XML file may be
unresponsive, possibly consuming all available CPU resources while
looping. Commands such as prstat(1M) can be used to determine the
utilization of system resources, for example:
$ prstat -s cpu
[…]

If the second issue has been exploited, the application which makes use
of the libxml2 library to process the crafted XML file may no longer be
available. Depending on the system configuration, core files may be
created and application crashes may be recorded in system logs.
4. Workaround
There are no workarounds for these issues. Please see the Resolution
section below.
5. Resolution
These issues are addressed in the following release:
SPARC Platform
* OpenSolaris based upon build snv_106 or later

A final resolution is pending completion for Solaris 9 and 10.
For more information on Security Sun Alerts, see Technical Instruction
ID 213557.
This Sun Alert notification is being provided to you on an “AS IS”
basis. This Sun Alert notification may contain information provided by
third parties. The issues described in this Sun Alert notification may
or may not impact your system(s). Sun makes no representations,
warranties, or guarantees as to the information contained herein. ANY
AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU
ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT
OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This
Sun Alert notification contains Sun proprietary and confidential
information. It is being provided to you pursuant to the provisions of
your agreement to purchase services from Sun, or, if you do not have
such an agreement, the Sun.com Terms of Use. This Sun Alert
notification may only be used for the purposes contemplated by these
agreements.
Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa
Clara, CA 95054 U.S.A. All rights reserved.
Attachments
This solution has no attachment

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFJiY4ik0kIxZMiiQ8RAicoAKCUGcijXsSYADUv4UANthAe3Ax/xgCgpsnN
mgn2qUOL0pT81NjBGxrvRlE=
=xFaD
—–END PGP SIGNATURE—–