Vulnerability-Lookup

CNVD-2016-11552

Vulnerability from cnvd - Published: 2016-11-28

Title

Soap Lite拒绝服务漏洞

Description

Soap Lite（又名the SOAP::Lite extension for Perl）是一个用于Perl模块为客户端和服务器端的简单对象访问协议（SOAP）提供了简单和轻量级的接口的集合。 Soap Lite 1.14及之前的版本中存在安全漏洞。攻击者可利用该漏洞造成拒绝服务（消耗大量的内存）。

Severity

中

Patch Name

Soap Lite拒绝服务漏洞的补丁

Patch Description

Soap Lite（又名the SOAP::Lite extension for Perl）是一个用于Perl模块为客户端和服务器端的简单对象访问协议（SOAP）提供了简单和轻量级的接口的集合。 Soap Lite 1.14及之前的版本中存在安全漏洞。攻击者可利用该漏洞造成拒绝服务（消耗大量的内存）。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://cpansearch.perl.org/src/PHRED/SOAP-Lite-1.20/Changes

Reference

http://cpansearch.perl.org/src/PHRED/SOAP-Lite-1.20/Changes

Impacted products

Name
Perl Soap Lite <=1.14

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "94487"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-8978"
    }
  },
  "description": "Soap Lite\uff08\u53c8\u540dthe SOAP::Lite extension for Perl\uff09\u662f\u4e00\u4e2a\u7528\u4e8ePerl\u6a21\u5757\u4e3a\u5ba2\u6237\u7aef\u548c\u670d\u52a1\u5668\u7aef\u7684\u7b80\u5355\u5bf9\u8c61\u8bbf\u95ee\u534f\u8bae\uff08SOAP\uff09\u63d0\u4f9b\u4e86\u7b80\u5355\u548c\u8f7b\u91cf\u7ea7\u7684\u63a5\u53e3\u7684\u96c6\u5408\u3002\r\n\r\nSoap Lite 1.14\u53ca\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff08\u6d88\u8017\u5927\u91cf\u7684\u5185\u5b58\uff09\u3002",
  "discovererName": "thilo-fester",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://cpansearch.perl.org/src/PHRED/SOAP-Lite-1.20/Changes",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-11552",
  "openTime": "2016-11-28",
  "patchDescription": "Soap Lite\uff08\u53c8\u540dthe SOAP::Lite extension for Perl\uff09\u662f\u4e00\u4e2a\u7528\u4e8ePerl\u6a21\u5757\u4e3a\u5ba2\u6237\u7aef\u548c\u670d\u52a1\u5668\u7aef\u7684\u7b80\u5355\u5bf9\u8c61\u8bbf\u95ee\u534f\u8bae\uff08SOAP\uff09\u63d0\u4f9b\u4e86\u7b80\u5355\u548c\u8f7b\u91cf\u7ea7\u7684\u63a5\u53e3\u7684\u96c6\u5408\u3002\r\n\r\nSoap Lite 1.14\u53ca\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff08\u6d88\u8017\u5927\u91cf\u7684\u5185\u5b58\uff09\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Soap Lite\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Perl Soap Lite \u003c=1.14"
  },
  "referenceLink": "http://cpansearch.perl.org/src/PHRED/SOAP-Lite-1.20/Changes",
  "serverity": "\u4e2d",
  "submitTime": "2016-11-25",
  "title": "Soap Lite\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2015-8978 (GCVE-0-2015-8978)

Vulnerability from cvelistv5 – Published: 2016-11-22 17:00 – Updated: 2024-08-06 08:36

Summary

In Soap Lite (aka the SOAP::Lite extension for Perl) 1.14 and earlier, an example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to one billion copies of the first entity. The amount of computer memory used for handling an external SOAP call would likely exceed that available to the process parsing the XML.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	http://www.securityfocus.com/bid/94487	vdb-entryx_refsource_BID
	http://cpansearch.perl.org/src/PHRED/SOAP-Lite-1.…	x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:36:30.737Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "94487",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94487"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://cpansearch.perl.org/src/PHRED/SOAP-Lite-1.20/Changes"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-11-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In Soap Lite (aka the SOAP::Lite extension for Perl) 1.14 and earlier, an example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to one billion copies of the first entity. The amount of computer memory used for handling an external SOAP call would likely exceed that available to the process parsing the XML."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "94487",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94487"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://cpansearch.perl.org/src/PHRED/SOAP-Lite-1.20/Changes"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8978",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Soap Lite (aka the SOAP::Lite extension for Perl) 1.14 and earlier, an example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to one billion copies of the first entity. The amount of computer memory used for handling an external SOAP call would likely exceed that available to the process parsing the XML."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "94487",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94487"
            },
            {
              "name": "http://cpansearch.perl.org/src/PHRED/SOAP-Lite-1.20/Changes",
              "refsource": "CONFIRM",
              "url": "http://cpansearch.perl.org/src/PHRED/SOAP-Lite-1.20/Changes"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8978",
    "datePublished": "2016-11-22T17:00:00",
    "dateReserved": "2016-11-22T00:00:00",
    "dateUpdated": "2024-08-06T08:36:30.737Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2016-11552

CVE-2015-8978 (GCVE-0-2015-8978)

Tags

Sightings

Nomenclature