OSVDB ID: 82161

Title: Apache Commons Compress bzip2 File Compression BZip2CompressorOutputStream Class File Handling Remote DoS

Info

Disclosure
May 23, 2012

Discovery
Unknown

Dates

Exploit
Unknown

Solution
May 23, 2012

Description

 Apache Commons Compress contains a flaw that that is triggered by an error when using bzip2 file compression, and will result in loss of availability for the program when handling a BZip2CompressorOutputStream class file.

Classification

 Location: Local / Remote, Context Dependent
Attack Type: Denial of Service
Impact: Loss of Availability
Solution: Upgrade
Exploit: Exploit Private
Disclosure: Vendor Verified

Solution

 Upgrade to version 1.4.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

The Apache Software Foundation

Apache Commons Compress

 1.0
1.1
1.2
1.3
1.4

Tika

 1.1

Plexus-Archiver

Plexus-Archiver

 2.3

Oracle Corporation

Solaris

 10
11.1

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/82161