CVE-2014-3660

What it actually does

The parser fails to honor disabled entity substitution, permitting unbounded recursive expansion of nested entities in XML input that exhausts CPU resources.

Why it matters to the business

Systems handling untrusted XML input can be forced offline or slowed to unusability, disrupting any services that rely on those systems until the load is removed.

How an attack unfolds

An attacker supplies a specially crafted XML document containing many nested entity references to any application that parses it with the vulnerable library, triggering repeated expansion and high CPU usage until the process or host becomes unresponsive.

How to fix it

Upgrade the affected packages to the listed fixed versions: openssh (Debian:11) to 1:6.9p1-1 or newer, openssh (Debian:12) to 1:6.9p1-1 or newer, openssh (Debian:13) to 1:6.9p1-1 or newer, and openssh (Ubuntu:14.04:LTS) to 1:6.6p1-2ubuntu2.2 or newer. Where direct upgrades are unavailable, disable XML entity expansion or implement strict input size limits before parsing.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the fixed version for each distribution, then test that a sample billion-laughs XML document is rejected or produces bounded resource usage.

Typical attack path

1. Identify a network-accessible service that accepts or processes XML documents
2. Craft an XML payload containing a large number of nested entity references
3. Deliver the payload to the target service
4. Observe resource exhaustion and service degradation or outage

How to detect it

Review application and system logs for sudden spikes in CPU usage correlated with XML parsing activity; examine any captured XML payloads for unusually deep or repetitive entity declarations.

What your security team should do

• Apply the listed package updates immediately on all affected Debian and Ubuntu systems
• Scan for any custom applications that embed or statically link the vulnerable parser and update them
• Add XML input validation and size limits as a defense-in-depth control
• Monitor CPU and process metrics on services that parse XML for anomalous sustained load