This update fixes an important security issue (CVE-2011-1755), for more information, please see https://bugzilla.redhat.com/show_bug.cgi?id=700390.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2011-006 applied.  This update contains numerous security-related fixes for the following components :

  - Apache
  - Application Firewall
  - ATS
  - BIND
  - Certificate Trust Policy
  - CFNetwork
  - CoreFoundation
  - CoreMedia
  - File Systems
  - IOGraphics
  - iChat Server
  - Mailman
  - MediaKit
  - PHP
  - postfix
  - python
  - QuickTime
  - Tomcat
  - User Documentation
  - Web Server
  - X11

The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.2. This version contains numerous security-related fixes for the following components :

  - Apache
  - Application Firewall
  - ATS
  - BIND
  - Certificate Trust Policy
  - CFNetwork
  - CoreMedia
  - CoreProcesses
  - CoreStorage
  - File Systems
  - iChat Server
  - Kernel
  - libsecurity
  - Open Directory
  - PHP
  - python
  - QuickTime
  - SMB File Server
  - X11

An updated jabberd package that fixes one security issue is now available for Red Hat Network Proxy 5.4.1 for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

This package provides jabberd 2, an Extensible Messaging and Presence Protocol (XMPP) server used for XML based communication.

It was found that the jabberd daemon did not properly detect recursion during entity expansion. A remote attacker could provide a specially crafted XML file containing a large number of nested entity references, which once processed by the jabberd daemon, could lead to a denial of service (excessive memory and CPU consumption).
(CVE-2011-1755)

Red Hat would like to thank Nico Golde of the Debian Security Team for reporting this issue. The Debian Security Team acknowledges Wouter Coekaerts as the original reporter.

Users of Red Hat Network Proxy 5.4.1 are advised to upgrade to this updated jabberd package, which resolves this issue. For this update to take effect, Red Hat Network Proxy must be restarted. Refer to the Solution section for details.

An updated jabberd package that fixes one security issue is now available for Red Hat Network Satellite 5.4.1 for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

This package provides jabberd 2, an Extensible Messaging and Presence Protocol (XMPP) server used for XML based communication.

It was found that the jabberd daemon did not properly detect recursion during entity expansion. A remote attacker could provide a specially crafted XML file containing a large number of nested entity references, which once processed by the jabberd daemon, could lead to a denial of service (excessive memory and CPU consumption).
(CVE-2011-1755)

Red Hat would like to thank Nico Golde of the Debian Security Team for reporting this issue. The Debian Security Team acknowledges Wouter Coekaerts as the original reporter.

Users of Red Hat Network Satellite 5.4.1 are advised to upgrade to this updated jabberd package, which resolves this issue. For this update to take effect, Red Hat Network Satellite must be restarted.
Refer to the Solution section for details.

Versions of Mac OS X 10.7 earlier than 10.7.2 are potentially affected by a security issue.  Mac OS X 10.7.2 contains a security fix for the following products : 

  - Apache

  - Application Firewall

  - ATS

 - BIND

  - Certificate Trust Policy

  - CFNetwork

  - CoreMedia

  - CoreProcesses

  - CoreStorage

  - File Systems

  - iChat Server

  - Kernel

  - libsecurity

  - Open Directory

  - PHP

  - python

  - QuickTime

  - SMB File Server

  - X11

ID	Name	Product	Family	Published	Updated	Severity
55059	Fedora 15 : jabberd-2.2.14-1.fc15 (2011-7801)	Nessus	Fedora Local Security Checks	6/12/2011	1/11/2021	medium
55150	Fedora 13 : jabberd-2.2.11-4.fc13 (2011-7818)	Nessus	Fedora Local Security Checks	6/16/2011	1/11/2021	medium
56481	Mac OS X Multiple Vulnerabilities (Security Update 2011-006)	Nessus	MacOS X Local Security Checks	10/13/2011	7/14/2018	critical
55149	Fedora 14 : jabberd-2.2.14-1.fc14 (2011-7805)	Nessus	Fedora Local Security Checks	6/16/2011	1/11/2021	medium
56480	Mac OS X 10.7.x < 10.7.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	10/13/2011	7/14/2018	critical
63984	RHEL 5 : jabberd (RHSA-2011:0881)	Nessus	Red Hat Local Security Checks	1/24/2013	1/14/2021	high
63985	RHEL 5 : jabberd (RHSA-2011:0882)	Nessus	Red Hat Local Security Checks	1/24/2013	1/14/2021	high
6039	Mac OS X 10.7 < 10.7.2 Multiple Vulnerabilities	Nessus Network Monitor	Generic	10/13/2011	3/6/2019	critical

Detections

Analytics

Plugins Search

medium

medium

critical

medium

critical

high

high

critical