CVE-2004-0989 Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via (1) a long FTP URL that is not properly handled b...
HighCVSS 10.0
EPSS 21.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via (1) a long FTP URL that is not properly handled by the xmlNanoFTPScanURL function, (2) a long proxy URL containing FTP data that is not properly handled by the xmlNanoFTPScanProxy function, and other overflows related to manipulation of DNS length values, including (3) xmlNanoFTPConnect, (4) xmlNanoHTTPConnectHost, and (5) xmlNanoHTTPConnectHost.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xmlsoft libxml | = 1.8.17 | No fix listed |
| xmlsoft libxml2 | = 2.5.11 | No fix listed |
| xmlsoft libxml2 | = 2.6.6 | No fix listed |
| xmlsoft libxml2 | = 2.6.7 | No fix listed |
| xmlsoft libxml2 | = 2.6.8 | No fix listed |
| xmlsoft libxml2 | = 2.6.9 | No fix listed |
| xmlsoft libxml2 | = 2.6.11 | No fix listed |
| xmlsoft libxml2 | = 2.6.12 | No fix listed |
| xmlsoft libxml2 | = 2.6.13 | No fix listed |
| xmlsoft libxml2 | = 2.6.14 | No fix listed |
| xmlstarlet command line xml toolkit | = 0.9.1 | No fix listed |
| redhat fedora core | = core_2.0 | No fix listed |
| trustix secure linux | = 2.0 | No fix listed |
| trustix secure linux | = 2.1 | No fix listed |
| ubuntu linux | = 4.1 | No fix listed |
| debian/libxml2(Debian:12) | < 2.6.11-5 | 2.6.11-5 |
| debian/libxml2(Debian:13) | < 2.6.11-5 | 2.6.11-5 |
| debian/libxml2(Debian:14) | < 2.6.11-5 | 2.6.11-5 |
References
- Debian Security Tracker CVE-2004-0989 vendor-advisory
- CLA-2004:890 vendor-advisory
- APPLE-SA-2005-01-25 vendor-advisory
- 20041026 libxml2 remote buffer overflows (not in xml parsing code though) mailing-list
- 13000 third-party-advisory
- 1011941 vdb-entry
- P-029 government-resource third-party-advisory
- DSA-582 vendor-advisory
- GLSA-200411-05 vendor-advisory
- SUSE-SR:2005:001 vendor-advisory
- 11179 vdb-entry
- 11180 vdb-entry
- 11324 vdb-entry
- RHSA-2004:615 vendor-advisory
- RHSA-2004:650 vendor-advisory
- 11526 exploit patch vdb-entry vendor-advisory
- libxml2-xmlnanoftpscanurl-bo(17870) vdb-entry
- libxml2-nanoftp-file-bo(17872) vdb-entry
- libxml2-xmlnanoftpscanproxy-bo(17875) vdb-entry
- libxml2-nanohttp-file-bo(17876) vdb-entry
- oval:org.mitre.oval:def:10505 signature vdb-entry
- oval:org.mitre.oval:def:1173 signature vdb-entry
- USN-89-1 vendor-advisory