libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

libxml2 has been updated to fix the following security issue :

  - CVE-2013-0338: libxml2 allowed context-dependent     attackers to cause a denial of service (CPU and memory     consumption) via an XML file containing an entity     declaration with long replacement text and many     references to this entity, aka 'internal entity     expansion' with linear complexity.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201412-11 (AMD64 x86 emulation base libraries: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in AMD64 x86 emulation       base libraries. Please review the CVE identifiers referenced below for       details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       cause a Denial of Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities has been discovered and corrected in libxml2 :

A denial of service flaw was found in the way libxml2, a library providing support to read, modify and write XML and HTML files, performed string substitutions when entity values for external entity references replacement (--noent option) was requested / enabled during the XML file parsing. A remote attacker could provide a specially crafted XML file containing an external entity expansion, when processed would lead to excessive CPU consumption (denial of service) (CVE-2013-0339). This a different flaw from CVE-2013-0338.

parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state (CVE-2013-2877).

The updated packages have been patched to correct these issues.

USN-1904-1 fixed vulnerabilities in libxml2. The update caused a regression for certain users. This update fixes the problem.

We apologize for the inconvenience.

It was discovered that libxml2 would load XML external entities by default. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly obtain access to arbitrary files or cause resource consumption. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, and Ubuntu 12.10.
(CVE-2013-0339)

It was discovered that libxml2 incorrectly handled documents that end abruptly. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service. (CVE-2013-2877).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that libxml2 would load XML external entities by default. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly obtain access to arbitrary files or cause resource consumption. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, and Ubuntu 12.10.
(CVE-2013-0339)

It was discovered that libxml2 incorrectly handled documents that end abruptly. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service. (CVE-2013-2877).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libxml2 has been updated to fix entity expansion problems :

  - Internal entity expansion within XML was not bounded,     leading to simple small XML files being able to cause     'out of memory' denial of service conditions.
    (CVE-2013-0338)

Kurt Seifried reports :

libxml2 is affected by the expansion of internal entities (which can be used to consume resources) and external entities (which can cause a denial of service against other services, be used to port scan, etc.)..

Brad Hill of iSEC Partners discovered that many XML implementations are vulnerable to external entity expansion issues, which can be used for various purposes such as firewall circumvention, disguising an IP address, and denial-of-service. libxml2 was susceptible to these problems when performing string substitution during entity expansion.

ID	Name	Product	Family	Severity
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	critical
83599	SUSE SLES10 Security Update : libxml2 (SUSE-SU-2013:1627-1)	Nessus	SuSE Local Security Checks	high
79964	GLSA-201412-11 : AMD64 x86 emulation base libraries: Multiple vulnerabilities (Heartbleed)	Nessus	Gentoo Local Security Checks	critical
69053	Mandriva Linux Security Advisory : libxml2 (MDVSA-2013:198)	Nessus	Mandriva Local Security Checks	medium
68957	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : libxml2 regression (USN-1904-2)	Nessus	Ubuntu Local Security Checks	medium
68903	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : libxml2 vulnerabilities (USN-1904-1)	Nessus	Ubuntu Local Security Checks	medium
66301	SuSE 10 Security Update : libxml2 (ZYPP Patch Number 8513)	Nessus	SuSE Local Security Checks	medium
66300	SuSE 11.2 Security Update : libxml2 (SAT Patch Number 7517)	Nessus	SuSE Local Security Checks	medium
65845	FreeBSD : libxml2 -- cpu consumption Dos (843a4641-9816-11e2-9c51-080027019be0)	Nessus	FreeBSD Local Security Checks	medium
65695	Debian DSA-2652-1 : libxml2 - external entity expansion	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-0339

critical

Tenable Plugins

critical

high

critical

medium

medium

medium

medium

medium

medium

medium