Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : libxml2 vulnerabilities (USN-644-1)

critical Nessus Plugin ID 37936
New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.

VPR Score: 6.7

Synopsis

The remote Ubuntu host is missing one or more security-related patches.

Description

It was discovered that libxml2 did not correctly handle long entity names. If a user were tricked into processing a specially crafted XML document, a remote attacker could execute arbitrary code with user privileges or cause the application linked against libxml2 to crash, leading to a denial of service. (CVE-2008-3529)

USN-640-1 fixed vulnerabilities in libxml2. When processing extremely large XML documents with valid entities, it was possible to incorrectly trigger the newly added vulnerability protections. This update fixes the problem. (CVE-2008-3281).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected packages.

See Also

https://usn.ubuntu.com/644-1/

Plugin Details

Severity: Critical

ID: 37936

File Name: ubuntu_USN-644-1.nasl

Version: 1.15

Type: local

Agent: unix

Published: 4/23/2009

Updated: 1/19/2021

Dependencies: 12634

Risk Information

Risk Factor: Critical

VPR Score: 6.7

CVSS v2.0

Base Score: 10

Temporal Score: 7.8

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: E:POC/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:libxml2, p-cpe:/a:canonical:ubuntu_linux:libxml2-dbg, p-cpe:/a:canonical:ubuntu_linux:libxml2-dev, p-cpe:/a:canonical:ubuntu_linux:libxml2-doc, p-cpe:/a:canonical:ubuntu_linux:libxml2-utils, p-cpe:/a:canonical:ubuntu_linux:python-libxml2, p-cpe:/a:canonical:ubuntu_linux:python-libxml2-dbg, p-cpe:/a:canonical:ubuntu_linux:python2.4-libxml2, cpe:/o:canonical:ubuntu_linux:6.06:-:lts, cpe:/o:canonical:ubuntu_linux:7.04, cpe:/o:canonical:ubuntu_linux:7.10, cpe:/o:canonical:ubuntu_linux:8.04:-:lts

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/11/2008

Reference Information

CVE: CVE-2008-3281, CVE-2008-3529

BID: 30783

USN: 644-1

CWE: 119, 399