CVE-2015-8978 Denial of service in n/a
An attacker can cause a denial of service in the Perl SOAP::Lite library by sending a crafted XML document that triggers excessive memory consumption via entity expansion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-8978?
CVE-2015-8978 is a high-severity denial of service vulnerability in n/a, published on 22 Nov 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Soap Lite (aka the SOAP::Lite extension for Perl) 1.14 and earlier, an example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to one billion copies of the first entity. The amount of computer memory used for handling an external SOAP call would likely exceed that available to the process parsing the XML.
Weakness: CWE-399
Which versions are affected by CVE-2015-8978?
It affects 1 product.
Linux distribution packages (1)
perl-SOAP-Lite SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 0.710.08-3.1 |
Products include Soap\ \.
How do I fix CVE-2015-8978?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2015-8978 being exploited?
There is no known exploitation of CVE-2015-8978 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2015-8978, DLA-723-1, GHSA-9xh5-ghq7-m3c5, MGASA-2017-0252, SUSE-SU-2016:3052-1.