full-disclosure - [CVE-2012-2098] Apache Commons Compress and Apache Ant denial of service vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 23 May 2012 16:00:48 +0200
From: Stefan Bodewig <bodewig@...che.org>
To: dev@...mons.apache.org, user@...mons.apache.org,
	dev@....apache.org, user@....apache.org, announce@...che.org,
	security@...che.org, full-disclosure@...ts.grok.org.uk,
	bugtraq@...urityfocus.com, David Jorm <djorm@...hat.com>
Subject: [CVE-2012-2098] Apache Commons Compress and
	Apache Ant denial of service vulnerability

CVE-2012-2098: Apache Commons Compress and Apache Ant denial of service
               vulnerability

Severity: Low

Vendor:
The Apache Software Foundation

Versions Affected:
Apache Commons Compress 1.0 to 1.4
Apache Ant 1.5 to 1.8.3

Description:
The bzip2 compressing streams in Apache Commons Compress and Apache Ant
internally use sorting algorithms with unacceptable worst-case
performance on very repetitive inputs.  A specially crafted input to
Compress' BZip2CompressorOutputStream or Ant's <bzip2> task can be used
to make the process spend a very long time while using up all available
processing time effectively leading to a denial of service.

Mitigation:
Commons Compress users should upgrade to 1.4.1
Ant users should upgrade to 1.8.4

Credit:
This issue was discovered by David Jorm of the Red Hat Security Response
Team.

References:
http://commons.apache.org/compress/security.html
http://ant.apache.org/security.html

Stefan Bodewig

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/