Re: CVE request: Inkscape fixes a XXE vulnerability during rasterization of SVG images

[Jan Lieskovsky <jlieskov () redhat com>]

Hi Kurt, Nicolas, vendors,

----- Original Message -----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/18/2012 08:44 PM, Kurt Seifried wrote:
> On 12/17/2012 01:27 PM, Nicolas Grégoire wrote:
>
> > Inkscape is vulnerable to XXE attacks during
> > rasterization/export of SVG images:
> > https://bugs.launchpad.net/inkscape/+bug/1025185
>
> > Impact: The impact of this vulnerability range form denial of 
> > service to file disclosure. Under Windows, it can also be used
> > to steal LM/NTLM hashes.
>
> > PoC: During rasterization, entities declared in the DTD are 
> > dereferenced and the content of the target file is included in
> > the output. Command-line used: "inkscape -e xxe-inkscape.png
> > xxe.svg" (PoC files are attached to the ticket)
>
> > References: CWE-827: Improper Control of Document Type Definition
> >  http://cwe.mitre.org/data/definitions/827.html
>
> > Regards, Nicolas Grégoire
>
> This already has a CVE reference in the page:
>
> CVE References
>
> 2012-1102
>
> To clarify that CVE was assigned to
> http://seclists.org/oss-sec/2012/q1/549
>
> http://seclists.org/oss-sec/2012/q1/549
>
> so this is probably an error, someone needs to tidy that bug up and
> post links to the source/etc so I can see whats going on.

That's correct. CVE-2012-1102 has been assigned to the
perl XML-Atom issue.

Assuming the source of the slight confusion is this comment:
https://bugs.launchpad.net/inkscape/+bug/1025185/comments/13

and the CVE id in the references.

But from the context of that bug, comment c#13 was used just
to reference patch for same issue in perl XML-Atom (CVE-2012-1102)
issue, when searching a patch for inkscape.

Which later resulted into upstream inkscape commit:
http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/11931

referenced in (subsequent) comment c#14:
https://bugs.launchpad.net/inkscape/+bug/1025185/comments/14

So CVE-2012-1102 identifier is for perl XML-Atom problem. And this
(same XXE problem) being present in inkscape should get a new
CVE id yet.

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

> - -- 
> Kurt Seifried Red Hat Security Response Team (SRT)
> PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
>
> iQIcBAEBAgAGBQJQ0TpTAAoJEBYNRVNeJnmToVkQAL15KAplZyCcwZFZR2PqVr0V
> ZbTvQXo93A3FuAlVDZ6FQQJSMU1E5EMpuD80816JLuUgFe1he/VwUoCtUknPdz5n
> cgXNCAHAtbEt54bCcRKoVCeFHTnYP0MzA2PDOoRFuRgkUoUwFv6ilL5dcZD8pehq
> ZwEWGVE/IDPJ+yFUma+FwtSP0olxoH6ZOP79RPgGoaPrCDfsLRjloKRKX4IUXSHy
> aN5wGNVd9RfCCdtjwb8Qd0DakXwqJ0B0spFDK6ZhbtJl7IxdQqEiIndJ6+EhJRQh
> A9njFDUjtIUM5jqUe7/Lb2Hzi5cno120dBKxvU/PLk0D7ZSErfI2ZneoxIIIdk42
> +kNQ1qT8/08QsnicVlqP9RpUiW9fqx4ndzazNUjCcTyegnjyYNm2VQlOC0quEDyo
> DzY2l2PED+A4HZ+gQW0uUcMWuDAaH7o2ti6CGUPgd5IPBYbBJpXBRZmw26QSD71M
> xs50rPHiJhuJiw8s6q7M/sq/rf7ixe/AtJ5bfYntzD9pCaxkG7Q/FZytEXjIwiGb
> +mqN6q52Gnc6R+neY22la/xwwRnRjYCDIUz/2r4Xt9EV1I5XbS9Zn24DDLE7YFJw
> KT1hWAa8GqvmUgv5FjB20M9AANyi7wxUlzdnKsiL3WOJdVpApE2cDpBC41PH9WDZ
> EN02SxWlecA1X7CgMGpc
> =Bzwi
> -----END PGP SIGNATURE-----