oss-sec mailing list archives
Handling cases of CWE-776
From: Tim Brown <tmb () 65535 com>
Date: Wed, 28 Oct 2009 00:02:40 +0000
All, How are problems with XML bombs (the so called "billion laughs" attack) being handled? Should I be filing such bugs against the applications that exposes the XML parser to user input or is it better to report the issue against the parser themselves. For example, the test case I've prepared for one affected parser simply causes the CPU to spin but the system appears to stay responsive (so far ;)). Is it even fair to call such a denial of service? (If the code was executed in a real application, no further processing would happen within the affected process as the parser is tied up in memmove()s). I'm just curious as I don't want to waste peoples time with the disclosure process if others are simply filing "standard" bugs against affected parsers and moving on to more interesting matters. Cheer, Tim -- Tim Brown <mailto:tmb () 65535 com>
Current thread:
- Handling cases of CWE-776 Tim Brown (Oct 27)
- Re: Handling cases of CWE-776 Marcus Meissner (Oct 28)
- Re: Handling cases of CWE-776 Tim Brown (Oct 28)
- Re: Handling cases of CWE-776 Tim Brown (Oct 28)
- Re: Handling cases of CWE-776 Tim Brown (Oct 28)
- Re: Handling cases of CWE-776 Steven M. Christey (Nov 09)
- Re: Handling cases of CWE-776 Marcus Meissner (Oct 28)