Data handling in Apache CXF - CVE-2017-12624

Vulnerability identifier: #VU11285

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-12624

CWE-ID: CWE-19

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to data handling. A remote attacker can send specially crafted message attachment header and cause the service to crash.

Apache CXF
z/Transaction Processing Facility ( z/TPF)
Dell Support Assist Enterprise
Tivoli Network Manager IP Edition
IBM Cognos Business Intelligence Server
IBM Security Guardium
IBM Cognos Analytics
Voice Gateway

Update to version 3.2.1 or 3.1.14.

Dell Support Assist Enterprise - update to 4.00.06.00
IBM Cognos Analytics - update to 11.0.13
Voice Gateway - addressed in versions 1.0.8.2, 1.0.8.6
Tivoli Network Manager IP Edition - update to 4.2.0.5

• http://cxf.apache.org/security-advisories.data/CVE-2017-12624.txt.asc

• Denial of service in Apache CXF
• Multiple vulnerabilities in IBM Cognos Business Intelligence Server
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in z/Transaction Processing Facility
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in IBM Voice Gateway
• Data handling in IBM Tivoli Network Manager IP Edition
• Multiple vulnerabilities in Dell Support Assist Enterprise