Vulnerability Details : CVE-2011-1753
expat_erl.c in ejabberd before 2.1.7 and 3.x before 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Vulnerability category: Denial of service
Products affected by CVE-2011-1753
- cpe:2.3:a:process-one:ejabberd:*:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:1.1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:0.9.8:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:1.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:0.9:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:0.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:1.1.14:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:1.1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.0.1_2:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:1.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:3.0.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:3.0.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:exmpp:*:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:exmpp:0.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:exmpp:0.9.4:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:exmpp:0.9.5:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:exmpp:0.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:exmpp:0.9.3:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2011-1753
6.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 93 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2011-1753
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2011-1753
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-1753
-
http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062099.html
[SECURITY] Fedora 15 Update: ejabberd-2.1.8-2.fc15
-
http://www.process-one.net/en/ejabberd/release_notes/release_note_ejabberd_2.1.7/
Download ejabberd - World's Most Popular XMPP Application Server
-
https://bugzilla.redhat.com/show_bug.cgi?id=700454
700454 – (CVE-2011-1753) CVE-2011-1753 ejabberd: DoS via the XML "billion laughs attack"
-
https://git.process-one.net/ejabberd/mainline/commit/bd1df027c622e1f96f9eeaac612a6a956c1ff0b6
Oops, can't find that - GitPatch
-
http://www.debian.org/security/2011/dsa-2248
Debian -- Security Information -- DSA-2248-1 ejabberd
-
http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062145.html
[SECURITY] Fedora 14 Update: ejabberd-2.1.8-2.fc14
-
http://www.securityfocus.com/bid/48072
ejabberd XML Parsing Denial of Service Vulnerability
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/67769
ejabberd XML denial of service CVE-2011-1753 Vulnerability Report
-
http://www.ejabberd.im/ejabberd-2.1.7
Patch
Jump to