ejabberd XML Parsing Denial of Service Vulnerability

http://www.securityfocus.com/bid/48072

Security Info

Bugtraq ID:	48072
Class:	Design Error
CVE:	CVE-2011-1753
Remote:	Yes
Local:	No
Published:	Jun 01 2011 12:00AM
Updated:	Jun 22 2012 12:10AM
Credit:	Wouter Coekaerts
Vulnerable:	Red Hat Fedora 15 Red Hat Fedora 14 Gentoo Linux ejabberd ejabberd 2.1.6

Not Vulnerable:

Security Discussion

ejabberd is prone to a vulnerability that may allow attackers to cause an affected application to consume excessive amounts of memory, resulting in a denial-of-service condition.

Proof of Concept and Security Exploits

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: vuldb@securityfocus.com.

Security Solution(s)

Solution:
Updates are available. Please see the references for more information.

Security References(s)

References:

ejabberd Homepage (ejabberd)
ejabberd Web Site (ejabberd)

Emagined Security Blog featuring Dr. Eugene Schultz

Secure Web Programming
by Vizual Services