CVE-2011-1425 Path traversal in n/a

Medium 5.1 Published 3 Apr 2011 Updated 6 Aug 2024

Remote attackers can create or overwrite arbitrary files via crafted XML signatures when XSLT is enabled in the XML Security Library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2011-1425?

CVE-2011-1425 is a medium-severity path traversal vulnerability in Apple Webkit, published on 3 Apr 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification.

Weakness: CWE-264

Which versions are affected by CVE-2011-1425?

It affects 2 products.

Linux distribution packages (29)

`xmlsec1` Red Hat:enterprise_linux:4::as	All versions	`0:1.2.6-3.2`
`xmlsec1-debuginfo` Red Hat:enterprise_linux:4::as	All versions	`0:1.2.6-3.2`
`xmlsec1-devel` Red Hat:enterprise_linux:4::as	All versions	`0:1.2.6-3.2`
`xmlsec1-openssl` Red Hat:enterprise_linux:4::as	All versions	`0:1.2.6-3.2`
`xmlsec1-openssl-devel` Red Hat:enterprise_linux:4::as	All versions	`0:1.2.6-3.2`
`xmlsec1` Red Hat:enterprise_linux:4::desktop	All versions	`0:1.2.6-3.2`
`xmlsec1-debuginfo` Red Hat:enterprise_linux:4::desktop	All versions	`0:1.2.6-3.2`
`xmlsec1-devel` Red Hat:enterprise_linux:4::desktop	All versions	`0:1.2.6-3.2`
`xmlsec1-openssl` Red Hat:enterprise_linux:4::desktop	All versions	`0:1.2.6-3.2`
`xmlsec1-openssl-devel` Red Hat:enterprise_linux:4::desktop	All versions	`0:1.2.6-3.2`
`xmlsec1` Red Hat:enterprise_linux:4::es	All versions	`0:1.2.6-3.2`
`xmlsec1-debuginfo` Red Hat:enterprise_linux:4::es	All versions	`0:1.2.6-3.2`
`xmlsec1-devel` Red Hat:enterprise_linux:4::es	All versions	`0:1.2.6-3.2`
`xmlsec1-openssl` Red Hat:enterprise_linux:4::es	All versions	`0:1.2.6-3.2`
`xmlsec1-openssl-devel` Red Hat:enterprise_linux:4::es	All versions	`0:1.2.6-3.2`
`xmlsec1` Red Hat:enterprise_linux:4::ws	All versions	`0:1.2.6-3.2`
`xmlsec1-debuginfo` Red Hat:enterprise_linux:4::ws	All versions	`0:1.2.6-3.2`
`xmlsec1-devel` Red Hat:enterprise_linux:4::ws	All versions	`0:1.2.6-3.2`
`xmlsec1-openssl` Red Hat:enterprise_linux:4::ws	All versions	`0:1.2.6-3.2`
`xmlsec1-openssl-devel` Red Hat:enterprise_linux:4::ws	All versions	`0:1.2.6-3.2`
`xmlsec1` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.9-8.1.2`
`xmlsec1-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.9-8.1.2`
`xmlsec1-devel` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.9-8.1.2`
`xmlsec1-gnutls` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.9-8.1.2`
`xmlsec1-gnutls-devel` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.9-8.1.2`
`xmlsec1-nss` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.9-8.1.2`
`xmlsec1-nss-devel` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.9-8.1.2`
`xmlsec1-openssl` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.9-8.1.2`
`xmlsec1-openssl-devel` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.9-8.1.2`

Products include Aleksey Xml Security Library, Apple Webkit.

How do I fix CVE-2011-1425?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2011-1425 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-1425 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as DEBIAN-CVE-2011-1425, DSA-2219-1, GHSA-63qq-pm7h-vc34, RHSA-2011:0486.