libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party libraries :

  - GnuTLS
  - Kernel
  - OpenSSL

libxml2 has been updated to fix the following security issue :

  - CVE-2013-0338: libxml2 allowed context-dependent     attackers to cause a denial of service (CPU and memory     consumption) via an XML file containing an entity     declaration with long replacement text and many     references to this entity, aka 'internal entity     expansion' with linear complexity.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities in the Web Listener subcomponent :

  - An integer overflow condition exists in libxml2 within     file xpath.c, related to XPath expressions when adding a     new namespace note. An unauthenticated, remote attacker     can exploit this, via a crafted XML file, to cause a     denial of service condition or the execution of arbitary     code. (CVE-2011-1944)

  - An integer overflow condition exists in the HTTP server,     specifically in the ap_pregsub() function within file     server/util.c, when the mod_setenvif module is enabled.
    A local attacker can exploit this to gain elevated     privileges by using an .htaccess file with a crafted     combination of SetEnvIf directives and HTTP request     headers. (CVE-2011-3607)

  - A flaw exists in libxml2, known as the 'internal entity     expansion' with linear complexity issue, that allows     specially crafted XML files to consume excessive CPU and     memory resources. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     by using a specially crafted XML file containing an     entity declaration with long replacement text and many     references to this entity. (CVE-2013-0338)

  - An out-of-bounds read error exists in libxml2 within     file parser.c due to a failure to check for the     XML_PARSER_EOF state. An unauthenticated, remote     attacker can exploit this, via a specially crafted     document that ends abruptly, to cause a denial of     service condition. (CVE-2013-2877)

  - A flaw exists within the mod_headers module in the     HTTP server which allows bypassing the 'RequestHeader     unset' directives. An unauthenticated, remote attacker     can exploit this to inject arbitrary headers. This is     done by placing a header in the trailer portion of data     being sent using chunked transfer encoding.
    (CVE-2013-5704)

  - A flaw exists in the dav_xml_get_cdata() function in     file main/util.c within the HTTP server mod_dav module     due to incorrect stripping of whitespace characters from     the CDATA sections. An unauthenticated, remote attacker     via a specially crafted DAV WRITE request, can exploit     this to cause a denial of service condition.
    (CVE-2013-6438)

  - A flaw exists in the log_cookie() function in file     mod_log_config.c within the HTTP server mod_log_config     module due to improper handling of specially crafted     cookies during truncation. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition via a segmentation fault. (CVE-2014-0098)

  - A flaw exists in libxml2, specifically in the     xmlParserHandlePEReference() function in file parser.c,     due to loading external parameter entities even when     entity substitution is disabled. An unauthenticated,     remote attacker can exploit this issue, via a specially     crafted XML file, to conduct XML External Entity (XXE)     attacks that exhaust CPU and memory resources, resulting     in a denial of service condition. (CVE-2014-0191)

  - A race condition exists in the HTTP server within the     mod_status module when using a threaded Multi-Processing     Module (MPM). If an unauthenticated, remote attacker is     able to access status pages served by mod_status, the     attacker can exploit this issue, by sending specially     crafted requests, to cause the httpd child process to     crash or possibly execute arbitrary code with the     privileges of the user running the web server.
    (CVE-2014-0226)

  - An unspecified flaw exists in the Web Listener     subcomponent that allows an unauthenticated, remote     attacker to impact confidentiality, integrity, and     availability. (CVE-2014-6571)

  - An unspecified flaw exists in the J2EE subcomponent that     allows an unauthenticated, remote attacker to disclose     potentially sensitive information. (CVE-2015-0372)

  - An unspecified flaw exists in the Web Listener     subcomponent that allows an unauthenticated, remote     attacker to cause a denial of service condition.
    (CVE-2015-0386)

According to its self-reported version number, the remote Junos device is affected by multiple vulnerabilities in the libxml2 library :

  - A heap-based buffer overflow vulnerability exists which     can result in arbitrary code execution. (CVE-2011-1944)

  - A denial of service vulnerability exists which can     result in excessive CPU consumption. (CVE-2012-0841)

  - A heap-based buffer overflow vulnerability exists in     the 'xmlParseAttValueComplex' function which can result     in arbitrary code execution. (CVE-2012-5134)

  - A denial of service vulnerability exists due to     excessive CPU and memory consumption in the processing     of XML files containing entity declarations with long     replacement text (also known as 'internal entity     expansion with linear complexity'). (CVE-2013-0338)

  - A denial of service vulnerability exists related to the     XML_PARSER_EOF state checking. (CVE-2013-2877)

These vulnerabilities can be exploited by a remote attacker via a specially crafted XML file.

The remote Solaris system is missing necessary patches to address security updates :

  - libxml2 2.9.0 and earlier allows context-dependent     attackers to cause a denial of service (CPU and memory     consumption) via an XML file containing an entity     declaration with long replacement text and many     references to this entity, aka 'internal entity     expansion' with linear complexity. (CVE-2013-0338)

The remote host is affected by the vulnerability described in GLSA-201412-11 (AMD64 x86 emulation base libraries: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in AMD64 x86 emulation       base libraries. Please review the CVE identifiers referenced below for       details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       cause a Denial of Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

libxml2 was updated to limit internal entity expansion denial of service problems (IXE) (CVE-2013-0338) (bnc#805233)

The remote VMware ESXi 5.1 host is affected by the following vulnerabilities :

  - A denial of service vulnerability exists in the bundled     OpenSSL library that is triggered when handling OCSP     response verification. A remote attacker can exploit     this to crash the program. (CVE-2013-0166)

  - An error exists related to the SSL/TLS/DTLS protocols,     CBC mode encryption and response time. An attacker     can obtain plaintext contents of encrypted traffic via     timing attacks. (CVE-2013-0169)

  - An error exists in the libxml2 library related to the     expansion of XML internal entities that could allow     denial of service attacks. (CVE-2013-0338)

  - A NULL pointer dereference flaw exists in the handling     of Network File Copy (NFC) traffic. An attacker can     exploit this by intercepting and modifying NFC traffic,     to cause a denial of service condition. (CVE-2014-1207)

  - A denial of service vulnerability exists in the handling     of invalid ports that could allow a guest user to crash     the VMX process. (CVE-2014-1208)

The remote VMware ESXi 5.0 host is affected by the following security vulnerabilities :

  - Multiple errors exist related to OpenSSL that could     allow information disclosure or denial of service     attacks. (CVE-2013-0166, CVE-2013-0169)

  - An error exists in the libxml2 library related to the     expansion of XML internal entities. An attacker can     exploit this to cause a denial of service. (CVE-2013-0338)

  - An unspecified error exists related to 'hostd-vmdb'. An     attacker can exploit this to cause a denial of service.
    (CVE-2013-5970)

  - An error exists in the handling of certain Virtual     Machine file descriptors. This may allow an unprivileged     user with the 'Add Existing Disk' privilege to obtain     read and write access to arbitrary files, possibly     leading to arbitrary code execution after a host reboot.
    (CVE-2013-5973)

  - A NULL pointer dereference flaw exists in the handling     of Network File Copy (NFC) traffic. This issue may lead     to a denial of service if an attacker intercepts and     modifies the NFC traffic. (CVE-2014-1207)

  - A denial of service vulnerability exists in the handling     of invalid ports that could allow a guest user to crash     the VMX process. (CVE-2014-1208)

The remote host is affected by the vulnerability described in GLSA-201311-06 (libxml2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libxml2. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted       document with an application linked against libxml2, possibly resulting       in execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka 'internal entity expansion' with linear complexity.

a. vCenter Server and ESX userworld update for OpenSSL library

   The userworld OpenSSL library is updated to version openssl-0.9.8y    to resolve multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2013-0169 and CVE-2013-0166 to these    issues.

b. Service Console (COS) update for OpenSSL library

   The Service Console updates for OpenSSL library is updated to version    openssl-0.9.8e-26.el5_9.1 to resolve multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2013-0169 and CVE-2013-0166 to these    issues.

c. ESX Userworld and Service Console (COS) update for libxml2 library 

   The ESX Userworld and Service Console libxml2 library is updated to    version libxml2-2.6.26-2.1.21.el5_9.1 and    libxml2-python-2.6.26-2.1.21.el5_9.1. to resolve a security issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2013-0338 to this issue.

d. Service Console (COS) update for GnuTLS library 

   The ESX service console GnuTLS RPM is updated to version    gnutls-1.4.1-10.el5_9.1 to resolve a security issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2013-2116 to this issue.

e. ESX third-party update for Service Console kernel 

   The ESX Service Console Operating System (COS) kernel is updated    to kernel-2.6.18-348.3.1.el5 which addresses several security    issues in the COS kernel. 

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2013-0268 and CVE-2013-0871 to these    issues.

From Red Hat Security Advisory 2013:0581 :

Updated libxml2 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

A denial of service flaw was found in the way libxml2 performed string substitutions when entity values for entity references replacement was enabled. A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, would lead to excessive CPU consumption. (CVE-2013-0338)

All users of libxml2 are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The desktop must be restarted (log out, then log back in) for this update to take effect.

libxml2 has been updated to fix entity expansion problems :

  - Internal entity expansion within XML was not bounded,     leading to simple small XML files being able to cause     'out of memory' denial of service conditions.
    (CVE-2013-0338)

Multiple vulnerabilities was found and corrected in libxml2 :

A heap-buffer overflow was found in the way libxml2 decoded certain XML entitites. A remote attacker could provide a specially crafted XML file, which once opened in an application linked against libxml would cause that application to crash, or, potentially, execute arbitrary code with the privileges of the user running the application (CVE-2012-5134).

A denial of service flaw was found in the way libxml2 performed string substitutions when entity values for entity references replacement was enabled. A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, would lead to excessive CPU consumption (CVE-2013-0338).

An Off-by-one error in libxml2 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors (CVE-2011-3102).

Multiple integer overflows in libxml2, on 64-bit Linux platforms allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors (CVE-2012-2807).

The updated packages have been patched to correct these issues.

Kurt Seifried reports :

libxml2 is affected by the expansion of internal entities (which can be used to consume resources) and external entities (which can cause a denial of service against other services, be used to port scan, etc.)..

It was discovered that libxml2 incorrectly handled XML entity expansion. An attacker could use this flaw to cause libxml2 to consume large amounts of resources, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Brad Hill of iSEC Partners discovered that many XML implementations are vulnerable to external entity expansion issues, which can be used for various purposes such as firewall circumvention, disguising an IP address, and denial-of-service. libxml2 was susceptible to these problems when performing string substitution during entity expansion.

Updated libxml2 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

A denial of service flaw was found in the way libxml2 performed string substitutions when entity values for entity references replacement was enabled. A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, would lead to excessive CPU consumption. (CVE-2013-0338)

All users of libxml2 are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The desktop must be restarted (log out, then log back in) for this update to take effect.

A denial of service flaw was found in the way libxml2 performed string substitutions when entity values for entity references replacement was enabled. A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, would lead to excessive CPU consumption. (CVE-2013-0338)

The desktop must be restarted (log out, then log back in) for this update to take effect.

ID	Name	Product	Family	Severity
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	critical
89666	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2013-0009) (remote check)	Nessus	Misc.	medium
83599	SUSE SLES10 Security Update : libxml2 (SUSE-SU-2013:1627-1)	Nessus	SuSE Local Security Checks	high
81002	Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities (January 2015 CPU)	Nessus	Web Servers	high
80957	Juniper Junos libxml2 Library Multiple Vulnerabilities (JSA10669)	Nessus	Junos Local Security Checks	high
80690	Oracle Solaris Third-Party Patch Update : libxml2 (cve_2013_0338_denial_of)	Nessus	Solaris Local Security Checks	medium
79964	GLSA-201412-11 : AMD64 x86 emulation base libraries: Multiple vulnerabilities (Heartbleed)	Nessus	Gentoo Local Security Checks	critical
74946	openSUSE Security Update : libxml2 (openSUSE-SU-2013:0552-1)	Nessus	SuSE Local Security Checks	medium
72037	ESXi 5.1 < Build 1483097 Multiple Vulnerabilities (remote check)	Nessus	Misc.	low
70879	ESXi 5.0 < Build 1311175 Multiple Vulnerabilities (remote check)	Nessus	Misc.	medium
70836	GLSA-201311-06 : libxml2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
69747	Amazon Linux AMI : libxml2 (ALAS-2013-188)	Nessus	Amazon Linux Local Security Checks	medium
69193	VMSA-2013-0009 : VMware vSphere, ESX and ESXi updates to third-party libraries	Nessus	VMware ESX Local Security Checks	medium
68767	Oracle Linux 5 / 6 : libxml2 (ELSA-2013-0581)	Nessus	Oracle Linux Local Security Checks	medium
66301	SuSE 10 Security Update : libxml2 (ZYPP Patch Number 8513)	Nessus	SuSE Local Security Checks	medium
66300	SuSE 11.2 Security Update : libxml2 (SAT Patch Number 7517)	Nessus	SuSE Local Security Checks	medium
66070	Mandriva Linux Security Advisory : libxml2 (MDVSA-2013:056)	Nessus	Mandriva Local Security Checks	medium
65845	FreeBSD : libxml2 -- cpu consumption Dos (843a4641-9816-11e2-9c51-080027019be0)	Nessus	FreeBSD Local Security Checks	medium
65730	Ubuntu 8.04 LTS / 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : libxml2 vulnerability (USN-1782-1)	Nessus	Ubuntu Local Security Checks	medium
65695	Debian DSA-2652-1 : libxml2 - external entity expansion	Nessus	Debian Local Security Checks	medium
64971	CentOS 5 / 6 : libxml2 (CESA-2013:0581)	Nessus	CentOS Local Security Checks	medium
64964	Scientific Linux Security Update : libxml2 on SL5.x, SL6.x i386/x86_64 (20130228)	Nessus	Scientific Linux Local Security Checks	medium
64945	RHEL 5 / 6 : libxml2 (RHSA-2013:0581)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2013-0338

critical

Tenable Plugins

critical

medium

high

high

high

medium

critical

medium

low

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium