ESA-09: Insecure XML Parsing Vulnerability in Walrus

[Eucalyptus Security Team]

ESA-09: Insecure XML Parsing Vulnerability in Walrus

====================================================================

Eucalyptus Security Advisory

Advisory ID:                  ESA-09

Date:                              2013-04-16

Severity Level:             Important

Affected Versions:       Eucalyptus 3.2.1 and earlier

CVE Number:               CVE-2012-4067

====================================================================

OVERVIEW

------------

A security vulnerability has been identified with the way Walrus parses

XML in some requests in Eucalyptus 3.2.1 and earlier. An update is now

available that resolves this issue. We advise immediately updating all

affected Eucalyptus installations following the instructions below.

DESCRIPTION

-------------

Walrus is a storage service included with Eucalyptus. Walrus was not

securely parsing XML messages containing Document Type Declarations

(DTDs). This flaw could be exploited by a remote unauthenticated

attacker to perform Denial of Service attacks against Walrus.

SOLUTION 

-------------

 

Eucalyptus version 3.2.2 resolves this issue. 

Please see http://www.eucalyptus.com/download/eucalyptus 

for instructions on downloading and upgrading to the latest 

Eucalyptus software.

CONTACT and HELP

-------------

Contact the Eucalyptus Security Team at secu...@eucalyptus.com.

Viktoria Felmetsger
Software Security Engineer
Eucalyptus Systems, Inc.

6755 Hollister Ave. | Goleta, CA | 93117
Office: 805-845-8000 x9023
Cell:    805-252-7627
Email: rus...@eucalyptus.com