CVE:CVE-2014-3004
CNNVD:CNNVD-201406-268
Castor是一套开源的Java数据绑定工具。该工具可以在Java对象、XML文本、SQL数据表以及LDAP目录之间绑定。
Castor 1.3.2及之前版本的Xerces SAX Parser默认配置中存在代码问题漏洞。攻击者可借助特制的XML文档利用该漏洞实施XML外部实体攻击。
solution:Upgrade castor_project castor to a higher version than 1.3.2,1.3,1.3.1,and avoid the version (,1.3.2],1.3,1.3.1; Upgrade opensuse opensuse to a higher version than 13.1,and avoid the version 13.1; Upgrade opensuse_project opensuse to a higher version than 12.3,and avoid the version 12.3