Red Hat JBoss Core Services Libxml2 XML Document resource management

Summaryinfo

A vulnerability classified as problematic has been found in Red Hat JBoss. The affected element is an unknown function in the library Libxml2 of the component Core Services. The manipulation as part of XML Document leads to resource management. This vulnerability is referenced as CVE-2016-9596. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Red Hat JBoss (Application Server Software) (version now known). It has been rated as problematic. This issue affects some unknown processing in the library Libxml2 of the component Core Services. The manipulation as part of a XML Document leads to a resource management vulnerability. Using CWE to declare the problem leads to CWE-399. Impacted is availability. The summary by CVE is:

libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (stack consumption) via a crafted XML document. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627.

The bug was discovered 12/22/2016. The weakness was published 08/16/2018 as Bug 1408302 as not defined bug report (Bugzilla). It is possible to read the advisory at bugzilla.redhat.com. The identification of this vulnerability is CVE-2016-9596 since 11/22/2016. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/16/2020).

The vulnerability was handled as a non-public zero-day exploit for at least 602 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entry is available at VDB-122976. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• Red Hat

Name

• JBoss

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion