CVE-2011-2206
First published: Wed Jun 22 2011(Updated: )
XMLParser.pm in DJabberd before 0.85 allows remote authenticated users to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference, a different vulnerability than CVE-2011-1757.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jabberd | <=0.84 | |
| Jabberd | =0.80 | |
| Jabberd | =0.81 | |
| Jabberd | =0.82 | |
| Jabberd | =0.83 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://groups.google.com/group/djabberd/msg/80a462d5c28873d7?dmode=source&output=gplain
- http://www.openwall.com/lists/oss-security/2011/06/14/6
- http://www.openwall.com/lists/oss-security/2011/06/15/5
- https://raw.github.com/djabberd/DJabberd/master/CHANGES
- https://github.com/djabberd/DJabberd/commit/b41d6dc247a175fe8e092d6ec2c460826fa62992
Frequently Asked Questions
What is the severity of CVE-2011-2206?
CVE-2011-2206 is classified as a moderate severity vulnerability as it allows authenticated users to read arbitrary files and potentially disrupt services.
How do I fix CVE-2011-2206?
To fix CVE-2011-2206, upgrade DJabberd to version 0.85 or later, which contains patches to mitigate the vulnerability.
What versions of DJabberd are affected by CVE-2011-2206?
CVE-2011-2206 affects all versions of DJabberd prior to version 0.85, including versions 0.80 to 0.84.
What types of attacks can CVE-2011-2206 enable?
CVE-2011-2206 can enable remote authenticated users to read arbitrary files, send unauthorized HTTP requests, and potentially cause denial of service.
Is CVE-2011-2206 exploitable remotely?
Yes, CVE-2011-2206 is exploitable remotely by authenticated users through XML external entity declarations.
- agent/first-publish-date
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/weakness
- agent/references
- agent/author
- agent/last-modified-date
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- agent/softwarecombine
- vendor/brad fitzpatrick
- canonical/jabberd
- version/jabberd/0.84
- version/jabberd/0.80
- version/jabberd/0.81
- version/jabberd/0.82
- version/jabberd/0.83