[Trisquel-security] [USN-1527-2] XML-RPC for C and C++ vulnerabilities

[Tyler Hicks]

==========================================================================
Ubuntu Security Notice USN-1527-2
September 10, 2012

xmlrpc-c vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS

Summary:

XML-RPC for C and C++ could be made to cause a denial of service by consuming
excessive CPU and memory resources.

Software Description:
- xmlrpc-c: Lightweight RPC library based on XML and HTTP

Details:

USN-1527-1 fixed vulnerabilities in Expat. This update provides the
corresponding updates for XML-RPC for C and C++. Both issues described in the
original advisory affected XML-RPC for C and C++ in Ubuntu 10.04 LTS, 11.04,
11.10 and 12.04 LTS.

Original advisory details:

 It was discovered that Expat computed hash values without restricting the
 ability to trigger hash collisions predictably. If a user or application
 linked against Expat were tricked into opening a crafted XML file, an attacker
 could cause a denial of service by consuming excessive CPU resources.
 (CVE-2012-0876)
 
 Tim Boddy discovered that Expat did not properly handle memory reallocation
 when processing XML files. If a user or application linked against Expat were
 tricked into opening a crafted XML file, an attacker could cause a denial of
 service by consuming excessive memory resources. This issue only affected
 Ubuntu 8.04 LTS, 10.04 LTS, 11.04 and 11.10. (CVE-2012-1148)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  libxmlrpc-core-c3               1.16.33-3.1ubuntu5.1

Ubuntu 11.10:
  libxmlrpc-core-c3-0             1.16.32-0ubuntu4.1

Ubuntu 11.04:
  libxmlrpc-core-c3-0             1.16.32-0ubuntu3.1

Ubuntu 10.04 LTS:
  libxmlrpc-core-c3               1.06.27-1ubuntu7.1

After a standard system upgrade you need to restart any applications linked
against XML-RPC for C and C++ to effect the necessary changes.

References:
  http://www.ubuntu.com/usn/usn-1527-2
  http://www.ubuntu.com/usn/usn-1527-1
  CVE-2012-0876, CVE-2012-1148

Package Information:
  https://launchpad.net/ubuntu/+source/xmlrpc-c/1.16.33-3.1ubuntu5.1
  https://launchpad.net/ubuntu/+source/xmlrpc-c/1.16.32-0ubuntu4.1
  https://launchpad.net/ubuntu/+source/xmlrpc-c/1.16.32-0ubuntu3.1
  https://launchpad.net/ubuntu/+source/xmlrpc-c/1.06.27-1ubuntu7.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <http://listas.trisquel.info/pipermail/trisquel-security/attachments/20120910/2293a09d/attachment.pgp>
-------------- next part --------------
-- 
ubuntu-security-announce mailing list
ubuntu-security-announce at lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce