Tenable Log Correlation Engine (LCE) < 4.8.0 Libxml2 DoS
Medium Nessus Plugin ID 90706
SynopsisA data aggregation application installed on the remote host is affected by a denial of service vulnerability.
DescriptionThe version of Tenable Log Correlation Engine (LCE) installed on the remote host is a version prior to 4.8.0. It is, therefore, affected by a denial of service vulnerability in the bundled version of Libxml2 due to an infinite loop condition in the xz_decomp() function. An unauthenticated, remote attacker can exploit this by convincing a user to input specially crafted XML content, to exhaust available system resources, resulting in a denial of service condition.
SolutionUpgrade to Tenable LCE version 4.8.0 or later.