CVE-2011-1753: billion laughs DoS vulnerability

[Felix Geyer]

Binary package hint: ejabberd

From http://www.debian.org/security/2011/dsa-2248

> Wouter Coekaerts discovered that ejabberd, a distributed XMPP/Jabber server
> written in Erlang, is vulnerable to the so-called "billion laughs" attack
> because it does not prevent entity expansion on received data.
> This allows an attacker to perform denial of service attacks against the
> service by sending specially crafted XML data to it.

[Felix Geyer (debfx)]

Upstream bug report: https://support.process-one.net/browse/EJAB-1451
Upstream fix: https://git.process-one.net/ejabberd/mainline/commit/bd1df027c622e1f96f9eeaac612a6a956c1ff0b6

The bug report states that all ejabberd versions before 2.1.7 are affected.

[Jamie Strandboge (jdstrand)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Jamie Strandboge (jdstrand)]

Oneiric is fixed via 2.1.6-2.1.

[Felix Geyer (debfx)]

natty fixed in 2.1.5-3+squeeze1build0.11.04.1

[Felix Geyer (debfx)]

debdiff for lucid

[Felix Geyer (debfx)]

debdiff for maverick

[Marc Deslauriers (mdeslaur)]

Thanks for the debdiffs, ACK.

Package are being built now, and will be released in the next few hours.

Thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package ejabberd - 2.1.5-2ubuntu0.1

---------------
ejabberd (2.1.5-2ubuntu0.1) maverick-security; urgency=low

  * SECURITY UPDATE: billion laughs DoS vulnerability (LP: #791730)
    - debian/patches/CVE-2011-1753.patch: patch from upstream
    - CVE-2011-1753
 -- Felix Geyer <email address hidden> Thu, 16 Jun 2011 12:06:06 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package ejabberd - 2.1.2-2ubuntu0.1

---------------
ejabberd (2.1.2-2ubuntu0.1) lucid-security; urgency=low

  * SECURITY UPDATE: billion laughs DoS vulnerability (LP: #791730)
    - debian/patches/CVE-2011-1753.patch: patch from upstream
    - CVE-2011-1753
 -- Felix Geyer <email address hidden> Thu, 16 Jun 2011 11:53:01 +0200

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug and helping to make Ubuntu better. The package referred to in this bug is in universe or multiverse and reported against a release of Ubuntu (hardy) which no longer receives updates outside of the explicitly supported LTS packages. While the bug against hardy is being marked "Won't Fix" for now, if you are interested feel free to post a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures'

Please feel free to report any other bugs you may find.