oss-sec mailing list archives
Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled
From: Tim <tim-security () sentinelchicken org>
Date: Tue, 3 Jun 2014 08:27:47 -0700
Hi Tomas, Thanks for looking into this. Sorry for the slow reply.
As far as I can see setExpandEntityReferences() controls what value is set for the create-entity-ref-nodes DOM parser feature: http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/file/cae04d181428/src/com/sun/org/apache/xerces/internal/jaxp/DocumentBuilderImpl.java#l158 http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/file/cae04d181428/src/com/sun/org/apache/xerces/internal/jaxp/DocumentBuilderImpl.java#l74 http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/file/cae04d181428/src/com/sun/org/apache/xerces/internal/impl/Constants.java#l427 The description in Java API docs is rather brief, xerces docs have more details: http://xerces.apache.org/xerces-j/features.html#create-entity-ref-nodes http://xerces.apache.org/xerces2-j/features.html#dom.create-entity-ref-nodes AFAICS, the feature does not aim to control if entity references are expanded, but only how exactly they appear in the resulting DOM tree.
Ok, that makes sense. Of course it is pointless for security if it doesn't affect parameter entities. I also find it odd that one of the only standard methods available to directly tweak entity behavior can only be implemented by setting a feature in Xerces that is non-standard.
Maybe your paper should rather mention parser features as external-general-entities and external-parameter-entities: http://docs.oracle.com/javase/7/docs/api/org/xml/sax/package-summary.html#package_description
I do mention the specific features that one needs to disable in order to make parsing safe. However, I didn't realize that that some of these features were standardized. Still, it would be quite confusing to any developer that doesn't spend extensive amounts of time researching each XML feature and understanding what needs to be turned off.
OWASP XXE document covers some of this, but actually mentions only one of the two features... https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing#Java
I did end up releasing my paper recently, which I believe has up-to-date recommendations for Xerces: http://vsecurity.com/download/papers/XMLDTDEntityAttacks.pdf Best, tim
Current thread:
- CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled Stefan Cornelius (May 06)
- Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled Nicolas Grégoire (May 06)
- Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled Tomas Hoger (May 06)
- Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled Nicolas Grégoire (May 06)
- Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled Timoth D. Morgan (May 08)
- Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled Tomas Hoger (May 12)
- Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled David Jorm (Jun 02)
- Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled Tim (Jun 03)
- Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled David Jorm (Jun 06)
- Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled Tomas Hoger (May 06)
- Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled Tim (Jun 03)
- Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled Tomas Hoger (Jun 09)
- Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled Tim (Jun 09)
- Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled Nicolas Grégoire (May 06)