Vulnerabilities > CVE-2017-1000061 - XXE vulnerability in Xmlsec Project Xmlsec

047910
CVSS 7.1 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
HIGH
local
low complexity
xmlsec-project
CWE-611
nessus

Summary

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service

Nessus

  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2017-890.NASL
    descriptionIt was discovered xmlsec1
    last seen2020-06-01
    modified2020-06-02
    plugin id103224
    published2017-09-15
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/103224
    titleAmazon Linux AMI : xmlsec1 (ALAS-2017-890)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Amazon Linux AMI Security Advisory ALAS-2017-890.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(103224);
      script_version("3.3");
      script_cvs_date("Date: 2018/04/18 15:09:36");
    
      script_cve_id("CVE-2017-1000061");
      script_xref(name:"ALAS", value:"2017-890");
    
      script_name(english:"Amazon Linux AMI : xmlsec1 (ALAS-2017-890)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Amazon Linux AMI host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "It was discovered xmlsec1's use of libxml2 inadvertently enabled
    external entity expansion (XXE) along with validation. An attacker
    could craft an XML file that would cause xmlsec1 to try and read local
    files or HTTP/FTP URLs, leading to information disclosure or denial of
    service. (CVE-2017-1000061)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://alas.aws.amazon.com/ALAS-2017-890.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Run 'yum update xmlsec1' to update your system."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xmlsec1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xmlsec1-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xmlsec1-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xmlsec1-gcrypt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xmlsec1-gcrypt-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xmlsec1-gnutls");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xmlsec1-gnutls-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xmlsec1-nss");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xmlsec1-nss-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xmlsec1-openssl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:xmlsec1-openssl-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2017/09/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/09/15");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2018 Tenable Network Security, Inc.");
      script_family(english:"Amazon Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/AmazonLinux/release");
    if (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux");
    os_ver = pregmatch(pattern: "^AL(A|\d)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
    os_ver = os_ver[1];
    if (os_ver != "A")
    {
      if (os_ver == 'A') os_ver = 'AMI';
      audit(AUDIT_OS_NOT, "Amazon Linux AMI", "Amazon Linux " + os_ver);
    }
    
    if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (rpm_check(release:"ALA", reference:"xmlsec1-1.2.20-7.4.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"xmlsec1-debuginfo-1.2.20-7.4.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"xmlsec1-devel-1.2.20-7.4.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"xmlsec1-gcrypt-1.2.20-7.4.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"xmlsec1-gcrypt-devel-1.2.20-7.4.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"xmlsec1-gnutls-1.2.20-7.4.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"xmlsec1-gnutls-devel-1.2.20-7.4.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"xmlsec1-nss-1.2.20-7.4.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"xmlsec1-nss-devel-1.2.20-7.4.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"xmlsec1-openssl-1.2.20-7.4.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"xmlsec1-openssl-devel-1.2.20-7.4.amzn1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "xmlsec1 / xmlsec1-debuginfo / xmlsec1-devel / xmlsec1-gcrypt / etc");
    }
    
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2017-891.NASL
    descriptionThe ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 has an out-of-order CloseBlob call, resulting in a use-after-free via a crafted file. (CVE-2017-1000061)
    last seen2020-06-01
    modified2020-06-02
    plugin id103225
    published2017-09-15
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/103225
    titleAmazon Linux AMI : GraphicsMagick (ALAS-2017-891)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Amazon Linux AMI Security Advisory ALAS-2017-891.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(103225);
      script_version("3.3");
      script_cvs_date("Date: 2018/04/18 15:09:36");
    
      script_cve_id("CVE-2017-11403");
      script_xref(name:"ALAS", value:"2017-891");
    
      script_name(english:"Amazon Linux AMI : GraphicsMagick (ALAS-2017-891)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Amazon Linux AMI host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 has
    an out-of-order CloseBlob call, resulting in a use-after-free via a
    crafted file. (CVE-2017-1000061)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://alas.aws.amazon.com/ALAS-2017-891.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Run 'yum update GraphicsMagick' to update your system."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:GraphicsMagick");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:GraphicsMagick-c++");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:GraphicsMagick-c++-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:GraphicsMagick-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:GraphicsMagick-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:GraphicsMagick-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:GraphicsMagick-perl");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2017/09/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/09/15");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2018 Tenable Network Security, Inc.");
      script_family(english:"Amazon Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/AmazonLinux/release");
    if (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux");
    os_ver = pregmatch(pattern: "^AL(A|\d)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
    os_ver = os_ver[1];
    if (os_ver != "A")
    {
      if (os_ver == 'A') os_ver = 'AMI';
      audit(AUDIT_OS_NOT, "Amazon Linux AMI", "Amazon Linux " + os_ver);
    }
    
    if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (rpm_check(release:"ALA", reference:"GraphicsMagick-1.3.26-3.11.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"GraphicsMagick-c++-1.3.26-3.11.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"GraphicsMagick-c++-devel-1.3.26-3.11.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"GraphicsMagick-debuginfo-1.3.26-3.11.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"GraphicsMagick-devel-1.3.26-3.11.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"GraphicsMagick-doc-1.3.26-3.11.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"GraphicsMagick-perl-1.3.26-3.11.amzn1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "GraphicsMagick / GraphicsMagick-c++ / GraphicsMagick-c++-devel / etc");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1194.NASL
    descriptionAccording to the version of the xmlsec1 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was discovered xmlsec1
    last seen2020-05-06
    modified2017-09-08
    plugin id103032
    published2017-09-08
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/103032
    titleEulerOS 2.0 SP2 : xmlsec1 (EulerOS-SA-2017-1194)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2020-9573355FF4.NASL
    descriptionUpdate to 1.2.29 that
    last seen2020-06-01
    modified2020-06-02
    plugin id133427
    published2020-02-03
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133427
    titleFedora 31 : xmlsec1 (2020-9573355ff4)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1193.NASL
    descriptionAccording to the version of the xmlsec1 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was discovered xmlsec1
    last seen2020-05-06
    modified2017-09-08
    plugin id103031
    published2017-09-08
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/103031
    titleEulerOS 2.0 SP1 : xmlsec1 (EulerOS-SA-2017-1193)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20170821_XMLSEC1_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - It was discovered xmlsec1
    last seen2020-03-18
    modified2017-08-22
    plugin id102677
    published2017-08-22
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102677
    titleScientific Linux Security Update : xmlsec1 on SL7.x x86_64 (20170821)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2017-2492.NASL
    descriptionFrom Red Hat Security Advisory 2017:2492 : An update for xmlsec1 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. XML Security Library is a C library based on LibXML2 and OpenSSL. The library was created with a goal to support major XML security standards
    last seen2020-06-01
    modified2020-06-02
    plugin id102633
    published2017-08-22
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102633
    titleOracle Linux 7 : xmlsec1 (ELSA-2017-2492)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-2492.NASL
    descriptionAn update for xmlsec1 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. XML Security Library is a C library based on LibXML2 and OpenSSL. The library was created with a goal to support major XML security standards
    last seen2020-06-01
    modified2020-06-02
    plugin id102634
    published2017-08-22
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102634
    titleRHEL 7 : xmlsec1 (RHSA-2017:2492)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2017-2492.NASL
    descriptionAn update for xmlsec1 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. XML Security Library is a C library based on LibXML2 and OpenSSL. The library was created with a goal to support major XML security standards
    last seen2020-06-01
    modified2020-06-02
    plugin id102881
    published2017-09-01
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102881
    titleCentOS 7 : xmlsec1 (CESA-2017:2492)

Redhat

advisories
bugzilla
id1437311
titleCVE-2017-1000061 xmlsec1: xmlsec vulnerable to external entity expansion
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 7 is installed
      ovaloval:com.redhat.rhba:tst:20150364027
    • OR
      • AND
        • commentxmlsec1-openssl-devel is earlier than 0:1.2.20-7.el7_4
          ovaloval:com.redhat.rhsa:tst:20172492001
        • commentxmlsec1-openssl-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20172492002
      • AND
        • commentxmlsec1-gcrypt is earlier than 0:1.2.20-7.el7_4
          ovaloval:com.redhat.rhsa:tst:20172492003
        • commentxmlsec1-gcrypt is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20172492004
      • AND
        • commentxmlsec1-gcrypt-devel is earlier than 0:1.2.20-7.el7_4
          ovaloval:com.redhat.rhsa:tst:20172492005
        • commentxmlsec1-gcrypt-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20172492006
      • AND
        • commentxmlsec1-gnutls-devel is earlier than 0:1.2.20-7.el7_4
          ovaloval:com.redhat.rhsa:tst:20172492007
        • commentxmlsec1-gnutls-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20172492008
      • AND
        • commentxmlsec1-nss is earlier than 0:1.2.20-7.el7_4
          ovaloval:com.redhat.rhsa:tst:20172492009
        • commentxmlsec1-nss is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20172492010
      • AND
        • commentxmlsec1-gnutls is earlier than 0:1.2.20-7.el7_4
          ovaloval:com.redhat.rhsa:tst:20172492011
        • commentxmlsec1-gnutls is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20172492012
      • AND
        • commentxmlsec1-nss-devel is earlier than 0:1.2.20-7.el7_4
          ovaloval:com.redhat.rhsa:tst:20172492013
        • commentxmlsec1-nss-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20172492014
      • AND
        • commentxmlsec1-devel is earlier than 0:1.2.20-7.el7_4
          ovaloval:com.redhat.rhsa:tst:20172492015
        • commentxmlsec1-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20172492016
      • AND
        • commentxmlsec1-openssl is earlier than 0:1.2.20-7.el7_4
          ovaloval:com.redhat.rhsa:tst:20172492017
        • commentxmlsec1-openssl is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20172492018
      • AND
        • commentxmlsec1 is earlier than 0:1.2.20-7.el7_4
          ovaloval:com.redhat.rhsa:tst:20172492019
        • commentxmlsec1 is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20172492020
rhsa
idRHSA-2017:2492
released2017-08-21
severityModerate
titleRHSA-2017:2492: xmlsec1 security update (Moderate)
rpms
  • xmlsec1-0:1.2.20-7.el7_4
  • xmlsec1-debuginfo-0:1.2.20-7.el7_4
  • xmlsec1-devel-0:1.2.20-7.el7_4
  • xmlsec1-gcrypt-0:1.2.20-7.el7_4
  • xmlsec1-gcrypt-devel-0:1.2.20-7.el7_4
  • xmlsec1-gnutls-0:1.2.20-7.el7_4
  • xmlsec1-gnutls-devel-0:1.2.20-7.el7_4
  • xmlsec1-nss-0:1.2.20-7.el7_4
  • xmlsec1-nss-devel-0:1.2.20-7.el7_4
  • xmlsec1-openssl-0:1.2.20-7.el7_4
  • xmlsec1-openssl-devel-0:1.2.20-7.el7_4