Resource exhaustion in Apache Commons Compress - CVE-2012-2098

Vulnerability identifier: #VU74271

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2012-2098

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to algorithmic complexity in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream). A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Apache Commons Compress
Voice Gateway
SecureTransport
webMethods BPM
User Entity Behavior Analytics
Log Analysis
IBM Cloud Pak for Data System
IBM Spectrum Control
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
watsonx.data
IBM InfoSphere Information Server

Install updates from vendor's website.

Apache Commons Compress - update to 1.4.1
Voice Gateway - update to 1.0.8.19
SecureTransport - update to 5.5-20220825
webMethods BPM - update to 11.1 Fix 9
Log Analysis - addressed in versions 1.3.7 FP2, 1.3.7.2 IF001A
watsonx.data - update to 2.0.2
IBM Cloud Pak for Data System - update to 2.0.2.1
User Entity Behavior Analytics - update to 5.0.2
IBM Spectrum Control - update to 5.4.10.2
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
IBM Security Verify Governance - update to 10.0.2.0.3
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 4

• http://secunia.com/advisories/49255
• http://ant.apache.org/security.html
• http://commons.apache.org/compress/security.html
• http://www.securitytracker.com/id?1027096
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081746.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081697.html
• http://packetstormsecurity.org/files/113014/Apache-Commons-Compress-Apache-Ant-Denial-Of-Service.html
• http://www.securityfocus.com/bid/53676
• http://osvdb.org/82161
• http://archives.neohapsis.com/archives/bugtraq/2012-05/0130.html
• http://secunia.com/advisories/49286
• http://www-01.ibm.com/support/docview.wss?uid=swg21644047
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105060.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105049.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75857
• https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E
• https://www.oracle.com/security-alerts/cpujan2021.html

• Denial of service in Apache Commons Compress
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in Axway SecureTransport (August 2022)
• Multiple vulnerabilities in IBM Cloud Pak for Data System
• Multiple vulnerabilities in IBM Intelligent Operations Center (IOC)
• Multiple vulnerabilities in IBM Spectrum Control
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in IBM Security Verify Governance
• Resource exhaustion in IBM watsonx.data
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM User Entity Behavior Analytics
• Multiple vulnerabilities in IBM webMethods BPM