Denial of Service Vulnerability in libxerces2-java: Infinite Loop via Malformed XML Input
Summary
CVE-2009-2625: XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a deni... Affects libxerces2-java versions < 2.9.1-4.1. Fixed in 2.9.1-4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxerces2-java is an open-source XML parser library that provides a robust and efficient way to process XML documents in Java applications. It is widely used in various software projects for its ability to handle XML data effectively. However, certain versions of this library are vulnerable to a denial of service attack due to improper handling of malformed XML input, which can lead to application hangs and infinite loops.
Vulnerability Detail
The vulnerability, identified as CVE-2009-2625, originates from the XMLScanner.java component of Apache Xerces2 Java. It affects Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20. Attackers can exploit this vulnerability by sending specially crafted XML input that causes the application to enter an infinite loop, resulting in a denial of service. This can severely impact the availability of applications relying on this library, making it crucial for developers to address this issue promptly.
How To Fix
Minimum fixed version
2.9.1-4.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxerces2-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider implementing input validation to filter out malformed XML before it reaches the XML parser. This can help mitigate the risk of triggering the vulnerability.
Conclusion
The CVE-2009-2625 vulnerability in libxerces2-java poses a significant risk of denial of service due to improper handling of malformed XML input. It is essential for developers to update their libraries to the fixed version to ensure application stability and security. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libxerces2-java →
FAQ
CVE-2009-2625 is a vulnerability in the libxerces2-java library that allows remote attackers to cause a denial of service through malformed XML input.
The vulnerability affects libxerces2-java versions prior to 2.9.1-4.1 in Debian-based systems.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to application hangs and denial of service, affecting the availability of services relying on the affected library.
Yes, implementing input validation to filter out malformed XML can serve as a temporary workaround until the library is updated.
Related vulnerabilities
Recent vulnerabilities recorded for libxerces2-java.
