OpenPKG Security Advisory

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2004.050
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2004.050
Advisory Published:      2010-02-09 16:49 UTC

Issue Id (internal):     OpenPKG-SI-20041031.01
Issue First Created:     2004-10-31
Issue Last Modified:     2006-11-28
Issue Revision:          06


Subject Name:            Libxml
Subject Summary:         Extensible Markup Language (XML) Parsing Library
Subject Home:            http://xmlsoft.org/
Subject Versions:        * <= 2.6.14

Vulnerability Id:        CVE-2004-0989
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           
Attack Impact:           arbitrary code execution

Description:
    According to BUGTRAQ posting [0], multiple vulnerabilities exist in
    the XML parsing library libxml [1]. Multiple buffer overflows may
    allow remote attackers to execute arbitrary code via a long FTP URL
    that is not properly handled by the "xmlNanoFTPScanURL" function,
    a long proxy URL containing FTP data that is not properly handled
    by the "xmlNanoFTPScanProxy" function, and other overflows related
    to the manipulation of DNS length values in "xmlNanoFTPConnect",
    "xmlNanoHTTPConnectHost", and "xmlNanoHTTPConnectHost".

References:
    [0] http://www.securityfocus.com/archive/1/379383/2004-10-24/2004-10-30/0
    [1] http://xmlsoft.org/
    [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0989
    [3] http://www.openpkg.org/tutorial.html#regular-source
    [4] http://www.openpkg.org/tutorial.html#regular-binary
    [5] ftp://ftp.openpkg.org/release/2.2/UPD/libxml-2.6.14-2.2.1.src.rpm
    [6] ftp://ftp.openpkg.org/release/2.1/UPD/libxml-2.6.11-2.1.1.src.rpm
    [7] ftp://ftp.openpkg.org/release/2.2/UPD/
    [8] ftp://ftp.openpkg.org/release/2.1/UPD/
    [9] http://www.openpkg.org/security.html#signature


Primary Package Name:    libxml
Primary Package Home:    http://openpkg.org/go/package/libxml

Affected Distribution:   Affected Branch:  Affected Package:
OpenPKG Community        2.1-SOLID         libxml-2.6.11-2.1.0
OpenPKG Community        2.2-SOLID         libxml-2.6.14-2.2.0
OpenPKG Community        CURRENT           libxml-2.6.14-20041022

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Community        2.1-SOLID         libxml-2.6.11-2.1.1
OpenPKG Community        2.2-SOLID         libxml-2.6.14-2.2.1
OpenPKG Community        CURRENT           libxml-2.6.15-20041028