CVE-2009-3720: Medium severity ibm engineering requirements management doors web access vulnerability
Peter Valchev discovered a flaw in the way expat handled malformed UTF-8 sequences when processing XML files. Incorrect UTF-8 sequenced could cause expat to fail to properly detect end of input and continue reading behind the end of input buffer. This results in a crash once reading reaches unmapped memory.
Non-public upstream bug report: http://sourceforge.net/tracker/?func=detail&aid=1990430&groupid=10127&atid=110127
Contents of the report leaked via expat-bugs mailing list posts: http://mail.python.org/pipermail/expat-bugs/2009-January/002781.html
Upstream patch: http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltokimpl.c?r1=1.13&r2=1.15
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=551936 https://bugs.gentoo.org/showbug.cgi?id=280615
Other sources
The Expat XML Parser is vulnerable to a denial of service, caused by an error when parsing UTF-8 sequences. A remote attacker could exploit this vulnerability to cause the application using the affected library to crash.
— IBM
The updatePosition function in lib/xmltokimpl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2009-3720?
CVE-2009-3720 is considered a critical vulnerability due to its potential to cause application crashes.
How do I fix CVE-2009-3720?
To mitigate CVE-2009-3720, update the affected expat or python packages to the specified remedial versions in the advisory.
Which software products are affected by CVE-2009-3720?
CVE-2009-3720 affects expat, python, and products such as IBM Engineering Requirements Management DOORS, along with Apache HTTP Server in specific versions.
What can happen if I don't address CVE-2009-3720?
Neglecting to address CVE-2009-3720 can lead to application instability and security risks due to crashes when processing malformed XML.
Who discovered the CVE-2009-3720 vulnerability?
CVE-2009-3720 was discovered by Peter Valchev.