CVE-2009-2473 Denial of service in n/a

Medium 4.3 Published 21 Aug 2009 Updated 7 Aug 2024

Attackers can cause denial of service via crafted XML documents exploiting entity expansion recursion in the neon library when expat is used.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2009-2473?

CVE-2009-2473 is a medium-severity denial of service vulnerability in n/a, published on 21 Aug 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

Weakness: CWE-399

Which versions are affected by CVE-2009-2473?

It affects 1 product.

Linux distribution packages (10)

`gnome-vfs2` Red Hat:enterprise_linux:5::client	All versions	`0:2.16.2-10.el5`
`gnome-vfs2-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:2.16.2-10.el5`
`gnome-vfs2-smb` Red Hat:enterprise_linux:5::client	All versions	`0:2.16.2-10.el5`
`gnome-vfs2` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:2.16.2-10.el5`
`gnome-vfs2-debuginfo` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:2.16.2-10.el5`
`gnome-vfs2-devel` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:2.16.2-10.el5`
`gnome-vfs2` Red Hat:enterprise_linux:5::server	All versions	`0:2.16.2-10.el5`
`gnome-vfs2-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:2.16.2-10.el5`
`gnome-vfs2-devel` Red Hat:enterprise_linux:5::server	All versions	`0:2.16.2-10.el5`
`gnome-vfs2-smb` Red Hat:enterprise_linux:5::server	All versions	`0:2.16.2-10.el5`

Products include Webdav Neon.

How do I fix CVE-2009-2473?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2009-2473 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-2473 exists.

Public exploit code: 1 Exploit-DB entry.

CVE-2008-3746 Null dereference in n/a Medium 4.3

Sources

Also known as GHSA-9vc6-7j3x-7x4v, RHSA-2013:0131.