[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 9 Jun 2014 12:28:58 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: tim-security@...tinelchicken.org
Subject: Re: CVE-2014-0191 libxml2: external parameter entity
loaded when entity substitution is disabled
On Tue, 3 Jun 2014 08:27:47 -0700 Tim wrote:
> > The description in Java API docs is rather brief, xerces docs have
> > more details:
> >
> > http://xerces.apache.org/xerces-j/features.html#create-entity-ref-nodes
> > http://xerces.apache.org/xerces2-j/features.html#dom.create-entity-ref-nodes
> >
> > AFAICS, the feature does not aim to control if entity references are
> > expanded, but only how exactly they appear in the resulting DOM
> > tree.
>
> Ok, that makes sense. Of course it is pointless for security if it
> doesn't affect parameter entities.
Sorry, how is this really relevant? setExpandEntityReferences(false)
does not prevent expansion of general entities, so I'm not sure why
expansion of parameter entities is the problem.
> I did end up releasing my paper recently, which I believe has
> up-to-date recommendations for Xerces:
> http://vsecurity.com/download/papers/XMLDTDEntityAttacks.pdf
It continues to mention setExpandEntityReferences, hinting that should
be expected to provide security protections (text seems to imply
external entities are not expanded in documents, but they are still
defined and remote URLs fetched). As previously mentioned, the setting
only changes DOM tree layout, and does not disable entity expansion.
E.g. parsing the following two inputs (one using internal other
external general entity):
$ cat test1.xml
<?xml version="1.0"?>
<!DOCTYPE bleh [
<!ENTITY bar "BAR">
]>
<root>foo &bar; baz</root>
$ cat test2.xml
<?xml version="1.0"?>
<!DOCTYPE bleh [
<!ENTITY bar SYSTEM "test2-bar.txt">
]>
<root>foo &bar; baz</root>
$ cat test2-bar.txt
BAR
Setting setExpandEntityReferences to false changes the tree from:
- (Element) <root>
- (Text) foo BAR baz
to:
- (Element) <root>
- (Text) foo
- (Entity Reference) &bar;
- (Text) BAR baz
&bar; is expanded to BAR either way.
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
