Improper Restriction of XML External Entity Reference in expat - CVE-2017-9233

Vulnerability identifier: #VU7242

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-9233

CWE-ID: CWE-611

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error within entityValueInitProcessor() function while parsing malformed XML in an external entity. An attacker can take advantage of this flaw to cause a denial of service against an application using the Expat library.

Successful exploitation of the vulnerability may allow an attacker to perform a denial of service attack.

expat
Arch Linux
Debian Linux
Ubuntu
Slackware Linux
Fedora
IBM Tivoli Monitoring
IBM Rational ClearCase
Telemetry Dashboard
Liquidware
Citrix Workspace App
Webex App VDI
expat (Alpine package)
expat
Cisco Jabber
Cisco Webex Meetings
VMware Horizon Client
IBM Security SiteProtector System
IBM HTTP Server
NetWorker Management Console

Update to version 2.2.1.

Telemetry Dashboard - update to 1.1.0.6 on Thin OS 2405
expat (Alpine package) - update to 2.2.0-r1
Liquidware - update to 6.7.0.2.2 on Thin OS 2405
Cisco Jabber - update to 14.3.0.308378.11 on Thin OS 2405
Citrix Workspace App - update to 24.2.0.65.17 on Thin OS 2405
Webex App VDI - update to 44.2.0.28744.1 on Thin OS 2405
Cisco Webex Meetings - update to 44.2.0.76.2 on Thin OS 2405
VMware Horizon Client - update to 2312.1.8.12.1.5 on Thin OS 2405
expat - addressed in versions 2.2.1-1.fc24, 2.2.1-1.fc25, 2.2.1-1.fc26
IBM Security SiteProtector System - update to 3.1.1.20
IBM HTTP Server - addressed in versions 7.0.0.45 Interim Fix PH50316, 8.0.0.15 Interim Fix PH50316, 8.5.5.23, 9.0.5.15
NetWorker Management Console - update to 19.12.0.1

• https://github.com/libexpat/libexpat/commit/c4bf96bb51dd2a1b0e185374362ee136fe2c9d7f
• https://libexpat.github.io/doc/cve-2017-9233/

• Debian update for expat
• Arch Linux update for expat
• Denial of service in expat
• Slackware Linux update for expat
• Ubuntu update for Expat
• Ubuntu update for Expat
• Slackware Linux update for python
• Arch Linux update for lib32-expat
• Improper Restriction of XML External Entity Reference in expat (Alpine package)
• Slackware Linux update for python
• Multiple vulnerabilities in IBM HTTP Server
• Multiple vulnerabilities in IBM Security SiteProtector System
• Multiple vulnerabilities in IBM Tivoli Monitoring
• Multiple vulnerabilities in IBM Rational ClearCase
• Multiple vulnerabilities in Dell ThinOS
• Fedora 25 update for expat
• Fedora 24 update for expat
• Fedora 26 update for expat
• Dell NetWorker Management Console update for third-party components