oss-sec mailing list archives
Re: RE: Handling CVEs for the XML entity expansion issues
From: Tim <tim-security () sentinelchicken org>
Date: Wed, 20 Feb 2013 12:06:06 -0800
Docbook uses it quite a bit, e.g. each chapter is a file, then you use external entities to put them all together, also for graphics/etc. Breaking Docbook would make me a sad panda.
Well sure, some minority of apps will break. Libraries release notes merely need to say "next version breaks backward compatibility for apps that use entities and inline DTDs. If your app uses these, explicitly enable with ..." Once again, "off by default", not removed.
I tend to agree, however for the billion laughs/linear attack that can be somewhat addressed, libxml for example addressed it by stopping all non linear expansion a few years ago, so while still vulnerable they are less vulnerable.
Yes, but this is by far the least interesting attack scenario for most XML libraries. Since libxml2 is pretty limited in it's entities support and network capabilities to begin with, it isn't as interesting of a case for XXE generally. However, other libraries leverage many platform network capabilities that make for some much more interesting attacks. tim
Current thread:
- Handling CVEs for the XML entity expansion issues Kurt Seifried (Feb 20)
- RE: Handling CVEs for the XML entity expansion issues Christey, Steven M. (Feb 20)
- Re: RE: Handling CVEs for the XML entity expansion issues Tim (Feb 20)
- Re: RE: Handling CVEs for the XML entity expansion issues Kurt Seifried (Feb 20)
- Re: RE: Handling CVEs for the XML entity expansion issues Tim (Feb 20)
- Re: RE: Handling CVEs for the XML entity expansion issues Kurt Seifried (Feb 20)
- Re: RE: Handling CVEs for the XML entity expansion issues Tim (Feb 20)
- Re: RE: Handling CVEs for the XML entity expansion issues Tim (Feb 20)
- RE: Handling CVEs for the XML entity expansion issues Christey, Steven M. (Feb 20)
- RE: RE: Handling CVEs for the XML entity expansion issues Christey, Steven M. (Feb 20)
- Re: RE: Handling CVEs for the XML entity expansion issues Kurt Seifried (Feb 20)