Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 461842 (CVE-2013-1864) - <net-libs/ptlib-2.10.10: denial of service processing certain XML documents (CVE-2013-1864)
Summary: <net-libs/ptlib-2.10.10: denial of service processing certain XML documents (...
Status: RESOLVED FIXED
Alias: CVE-2013-1864
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [noglsa]
Keywords:
Depends on: 464182
Blocks: CVE-2012-5621
  Show dependency tree
 
Reported: 2013-03-15 18:13 UTC by Agostino Sarubbo
Modified: 2015-01-29 13:23 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-03-15 18:13:27 UTC 
From ${URL} :

A flaw in ptlib prior to 2.12.1 was fixed [1]; this prevents the "billion laughs" denial of service 
attack.  This attack is due to improper length checks/recursion detection during XML entity 
expansion.  If an attacker were able to provide as input a crafted XML document containing a large 
number of nested entity references, they could cause the application linked to ptlib (for example, 
Ekiga) to consume extreme amounts of CPU and memory.

[1] http://opalvoip.svn.sourceforge.net/viewvc/opalvoip?view=revision&revision=28856
Comment 1 Chí-Thanh Christopher Nguyễn gentoo-dev 2013-03-17 13:58:59 UTC 
This is already fixed in ptlib-2.10.10
Comment 2 Sean Amoss (RETIRED) gentoo-dev Security 2013-03-19 10:46:04 UTC 
(In reply to comment #1)
> This is already fixed in ptlib-2.10.10

Is this ready to be marked stable?
Comment 3 Chí-Thanh Christopher Nguyễn gentoo-dev 2013-03-25 15:54:57 UTC 
Arches, please stabilize
net-libs/ptlib-2.10.10
net-libs/opal-3.10.10

Target keywords: alpha amd64 ia64 ppc ppc64 sparc x86
Comment 4 Agostino Sarubbo gentoo-dev 2013-03-25 21:14:17 UTC 
(In reply to comment #3)
> Arches, please stabilize
> net-libs/ptlib-2.10.10
> net-libs/opal-3.10.10
> 
> Target keywords: alpha amd64 ia64 ppc ppc64 sparc x86

This will cause a downgrade for ekiga's users: the ebuild says:
        <net-libs/opal-3.10.8[audio,sip,video,debug=,h323?]
        <net-libs/ptlib-2.10.8[ldap?,stun,v4l?,video,wav,debug=]

What we should do?
Comment 5 Jesus Rivero (RETIRED) gentoo-dev 2013-03-25 21:44:10 UTC 
Probably stabilize net-voip/ekiga-4.0.0-r1 since current stable ekiga does not work with these versions of net-libs/{opal,ptlib}
Comment 6 Agostino Sarubbo gentoo-dev 2013-03-28 22:43:34 UTC 
amd64 stable
Comment 7 Agostino Sarubbo gentoo-dev 2013-03-28 22:45:23 UTC 
x86 stable
Comment 8 Agostino Sarubbo gentoo-dev 2013-03-30 09:38:25 UTC 
ppc stable
Comment 9 Agostino Sarubbo gentoo-dev 2013-04-01 19:44:42 UTC 
ia64 stable
Comment 10 Agostino Sarubbo gentoo-dev 2013-04-01 19:53:04 UTC 
alpha stable
Comment 11 Agostino Sarubbo gentoo-dev 2013-04-05 18:12:17 UTC 
ppc64 stable
Comment 12 Chris Reffett (RETIRED) gentoo-dev Security 2013-09-11 03:55:14 UTC 
sparc team: *ping*
Comment 13 Chí-Thanh Christopher Nguyễn gentoo-dev 2013-09-11 08:11:22 UTC 
sparc is blocked by bug 464182
Comment 14 Raúl Porcel (RETIRED) gentoo-dev 2014-08-04 18:47:29 UTC 
sparc stable
Comment 15 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2014-08-04 18:55:33 UTC 
Cleanup, please!

GLSA vote: no
Comment 16 Tobias Heinlein (RETIRED) gentoo-dev 2014-08-04 19:31:56 UTC 
NO too, keeping open for cleanup.
Comment 17 GLSAMaker/CVETool Bot gentoo-dev 2014-08-19 22:40:37 UTC 
CVE-2013-1864 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1864):
  The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga
  before 4.0.1, does not properly detect recursion during entity expansion,
  which allows remote attackers to cause a denial of service (memory and CPU
  consumption) via a crafted PXML document containing a large number of nested
  entity references, aka a "billion laughs attack."
Comment 18 Yury German Gentoo Infrastructure gentoo-dev 2014-12-29 02:09:40 UTC 
Maintaner(s): Please drop affected versions, security will remove in 30 days if no response.
Comment 19 Kristian Fiskerstrand (RETIRED) gentoo-dev 2015-01-29 13:23:12 UTC 
Cleanup done, closing

 29 Jan 2015; Kristian Fiskerstrand <k_f@gentoo.org> -ptlib-2.10.9.ebuild,
  -ptlib-2.6.7-r1.ebuild:
  Security cleanup c.f bug #461842