libxslt was prone to an out-of-bounds read flaw when parsing certain patterns (CVE-2011-3970). This could lead to a Denial of Service.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-927:01 advisory.

    This C library allows to transform XML files into other XML files (or HTML, text, ...) using the standard     XSLT stylesheet transformation mechanism. To use it you need to have a version of libxml2 >= 2.6.27     installed. The xsltproc command is a command line interface to the XSLT engine     Security issues fixed with this release:
     CVE-2011-1202     The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome     before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive     information about heap memory addresses via an XML document containing a call to the XSLT generate-id     XPath function.
     CVE-2011-3970     libxslt, as used in Google Chrome before 17.0.963.46, allows remote attackers to cause a denial of service     (out-of-bounds read) via unspecified vectors.
     CVE-2012-2825     The XSL implementation in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of     service (incorrect read operation) via unspecified vectors.
     CVE-2012-2870     libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory,     which might allow remote attackers to cause a denial of service (application crash) via a crafted XSLT     expression that is not properly identified during XPath navigation, related to (1) the     xsltCompileLocationPathPattern function in libxslt/pattern.c and (2) the xsltGenerateIdFunction function     in libxslt/functions.c.
     CVE-2012-2871     libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly support a     cast of an unspecified variable during handling of XSL transforms, which allows remote attackers to cause     a denial of service or possibly have unknown other impact via a crafted document, related to the _xmlNs     data structure in include/libxml/tree.h.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A heap-based buffer overflow flaw was found in the way libxslt applied templates to nodes selected by certain namespaces. An attacker could use this flaw to create a malicious XSL file that, when used by an application linked against libxslt to perform an XSL transformation, could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application.
(CVE-2012-2871)

Several denial of service flaws were found in libxslt. An attacker could use these flaws to create a malicious XSL file that, when used by an application linked against libxslt to perform an XSL transformation, could cause the application to crash. (CVE-2012-2825, CVE-2012-2870, CVE-2011-3970)

An information leak could occur if an application using libxslt processed an untrusted XPath expression, or used a malicious XSL file to perform an XSL transformation. If combined with other flaws, this leak could possibly help an attacker bypass intended memory corruption protections. (CVE-2011-1202)

All running applications linked against libxslt must be restarted for this update to take effect.

Lot of security fixes and a few other bugs

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Chris Evans discovered that libxslt incorrectly handled generate-id XPath functions. If a user or automated system were tricked into processing a specially crafted XSLT document, a remote attacker could obtain potentially sensitive information. This issue only affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS and Ubuntu 11.04. (CVE-2011-1202)

It was discovered that libxslt incorrectly parsed certain patterns. If a user or automated system were tricked into processing a specially crafted XSLT document, a remote attacker could cause libxslt to crash, causing a denial of service. (CVE-2011-3970)

Nicholas Gregoire discovered that libxslt incorrectly handled unexpected DTD nodes. If a user or automated system were tricked into processing a specially crafted XSLT document, a remote attacker could cause libxslt to crash, causing a denial of service. (CVE-2012-2825)

Nicholas Gregoire discovered that libxslt incorrectly managed memory.
If a user or automated system were tricked into processing a specially crafted XSLT document, a remote attacker could cause libxslt to crash, causing a denial of service. (CVE-2012-2870)

Nicholas Gregoire discovered that libxslt incorrectly handled certain transforms. If a user or automated system were tricked into processing a specially crafted XSLT document, a remote attacker could cause libxslt to crash, causing a denial of service, or possibly execute arbitrary code. (CVE-2012-2871)

Cris Neckar discovered that libxslt incorrectly managed memory. If a user or automated system were tricked into processing a specially crafted XSLT document, a remote attacker could cause libxslt to crash, causing a denial of service, or possibly execute arbitrary code.
(CVE-2012-2893).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

a. VMware vSphere client-side authentication memory corruption    vulnerability

   VMware vCenter Server, vSphere Client, and ESX contain a    vulnerability in the handling of the management authentication    protocol. To exploit this vulnerability, an attacker must    convince either vCenter Server, vSphere Client or ESX to    interact with a malicious server as a client. Exploitation of    the issue may lead to code execution on the client system.
        To reduce the likelihood of exploitation, vSphere components    should be deployed on an isolated management network.
        The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2013-1405 to this issue.

b. Update to ESX/ESXi libxml2 userworld and service console

   The ESX/ESXi userworld libxml2 library has been updated to    resolve multiple security issues. Also, the ESX service console    libxml2 packages are updated to the following versions :

     libxml2-2.6.26-2.1.15.el5_8.5      libxml2-python-2.6.26-2.1.15.el5_8.5

   These updates fix multiple security issues. The Common    Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2011-3102 and CVE-2012-2807 to these    issues.

c. Update to ESX service console bind packages

   The ESX service console bind packages are updated to the    following versions :

     bind-libs-9.3.6-20.P1.el5_8.2      bind-utils-9.3.6-20.P1.el5_8.2

   These updates fix a security issue. The Common Vulnerabilities    and Exposures project (cve.mitre.org) has assigned the name    CVE-2012-4244 to this issue.

d. Update to ESX service console libxslt package

   The ESX service console libxslt package is updated to version    libxslt-1.1.17-4.el5_8.3 to resolve multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2011-1202, CVE-2011-3970,    CVE-2012-2825, CVE-2012-2870, and CVE-2012-2871 to these issues.

A heap-based buffer overflow flaw was found in the way libxslt applied templates to nodes selected by certain namespaces. An attacker could use this flaw to create a malicious XSL file that, when used by an application linked against libxslt to perform an XSL transformation, could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application.
(CVE-2012-2871)

Several denial of service flaws were found in libxslt. An attacker could use these flaws to create a malicious XSL file that, when used by an application linked against libxslt to perform an XSL transformation, could cause the application to crash. (CVE-2012-2825 , CVE-2012-2870 , CVE-2011-3970)

An information leak could occur if an application using libxslt processed an untrusted XPath expression, or used a malicious XSL file to perform an XSL transformation. If combined with other flaws, this leak could possibly help an attacker bypass intended memory corruption protections. (CVE-2011-1202)

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several components and third-party libraries :

  - Authentication Service
  - bind
  - libxml2
  - libxslt

ID	名前	製品	ファミリー	公開日	更新日	深刻度
75939	openSUSE Security Update : libxslt (openSUSE-SU-2012:0343-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
284073	MiracleLinux 3 : libxslt-1.1.17-4.3.0.1.AXS3 (AXSA:2012-927:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
62107	Scientific Linux Security Update : libxslt on SL5.x, SL6.x i386/x86_64 (20120913)	Nessus	Scientific Linux Local Security Checks	2012/9/15	2021/1/14	medium
62326	Fedora 16 : libxslt-1.1.26-9.fc16 (2012-14048)	Nessus	Fedora Local Security Checks	2012/9/27	2021/1/11	medium
62435	Ubuntu 8.04 LTS / 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : libxslt vulnerabilities (USN-1595-1)	Nessus	Ubuntu Local Security Checks	2012/10/5	2019/9/19	medium
64642	VMSA-2013-0001 : VMware vSphere security updates for the authentication service and third-party libraries	Nessus	VMware ESX Local Security Checks	2013/2/16	2021/1/6	critical
69613	Amazon Linux AMI : libxslt (ALAS-2012-123)	Nessus	Amazon Linux Local Security Checks	2013/9/4	2018/4/18	medium
89661	VMware ESX / ESXi Authentication Service and Third-Party Libraries Multiple Vulnerabilities (VMSA-2013-0001) (remote check)	Nessus	Misc.	2016/3/4	2018/11/15	critical

検出

プラグインの検索

medium

critical

medium

medium

medium

critical

medium

critical