[Japanese]

JVNDB-2013-000080

PHP OpenID Library vulnerable to XML external entity injection

Overview

The PHP OpenID Library contains an XML external entity injection vulnerability.

Takeshi Terada from Mitsui Bussan Secure Directions, Inc. and Kosuke Ebihara reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V2 Severity:
Base Metrics 6.4 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Low
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: None
  • Availability Impact: Partial
Affected Products


JanRain
  • PHP OpenID Library versions 2.2.2 and earlier

Impact

When processing specially crafted XRDS data, information on the server may be disclosed or server resources may be consumed excessively.
Solution

[Apply a Patch]
The source code in the repository has been fixed. Please apply the fixed code according to the code committed by the developer.
Vendor Information

JanRain
CWE (What is CWE?)

  1. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2013-4701
References

  1. JVN : JVN#24713981
  2. National Vulnerability Database (NVD) : CVE-2013-4701
Revision History

  • [2013/08/21]
      Web page was published
    [2013/08/23]
      References : Content was added

Date Public2013/08/21
Date First Published2013/08/21
Date Last Updated2013/08/23