XML flaws threaten 'enormous' array of apps

#1

Post by mindhacker » Thu, Aug 06, 2009, 10:31 AM UTC

XML flaws threaten 'enormous' array of apps
theregister.co.uk

Re: XML flaws threaten 'enormous' array of apps

#2

Post by cema » Thu, Aug 06, 2009, 11:33 AM UTC

Because of the nature of the flaw, details have not been published. (Also see the original article at http://www.codenomicon.com/labs/xml/) Not clear what can be done about the issue, and how bad the issue is. Should we just wait for it to be resolved?

Re: XML flaws threaten 'enormous' array of apps

#3

Post by tybris » Thu, Aug 06, 2009, 11:50 AM UTC

Unless they can trigger an infinite loop I'm not really worried about Java/Python based web services being affected. Any exception should be caught on a per-request basis.

Re: XML flaws threaten 'enormous' array of apps

#4

Post by jeroen » Thu, Aug 06, 2009, 11:54 AM UTC

"xml parser flaws"

Re: XML flaws threaten 'enormous' array of apps

#5

Post by DanielStraight » Thu, Aug 06, 2009, 12:00 PM UTC

Pretty much a useless article without some explanation of what the flaw is.

Re: XML flaws threaten 'enormous' array of apps

#6

Post by jcromartie » Thu, Aug 06, 2009, 12:03 PM UTC

The original article sounds like a scare/marketing piece:

    "Targets: Anything that uses XML"

Re: XML flaws threaten 'enormous' array of apps

#7

Post by tow21 » Thu, Aug 06, 2009, 12:13 PM UTC

Poorly written XML parsers (and I've written my fair share) are always open to DOS attacks; XML has no upper bound on element names, attribute value length, stack depth ...

http://en.wikipedia.org/wiki/Billion_laughs

Same is mostly true of JSON parsers as well of course.

If you let potentially hostile users feed arbitrary data into any of these, even a totally non-buggy, perfectly conformant parser is wide-open to being abused via DOS.

Re: XML flaws threaten 'enormous' array of apps

#8

Post by jacquesm » Thu, Aug 06, 2009, 12:18 PM UTC

tow21 wrote: post #7

Poorly written XML parsers (and I've written my fair share) are always open to DOS attacks; XML has no upper bound on element names, attribute value length, stack depth ... http://en.wikipedia.org/wiki/Billion_laughs Same is mostly true of JSON parsers as well of course. If you let potentially hostile users feed arbitrary data into any of these, even a totally non-buggy, perfectly conformant parser is wide-open to be…

That's a nasty little xml document. Interesting how any kind of simple macro expansion system is wide open to this kind of attack.

My guess is that to distinguish between 'legitimate' cases and 'attacks' is on par with solving the halting problem.

Re: XML flaws threaten 'enormous' array of apps

#9

Post by sgoranson » Thu, Aug 06, 2009, 12:48 PM UTC

Pretty skeptical this flaw could be in "virtually every open-source XML library available". Seems unlikely a million brains collectively missed whatever this is.

Re: XML flaws threaten 'enormous' array of apps

#10

Post by roc » Thu, Aug 06, 2009, 12:55 PM UTC

tow21 wrote: post #7

Poorly written XML parsers (and I've written my fair share) are always open to DOS attacks; XML has no upper bound on element names, attribute value length, stack depth ... http://en.wikipedia.org/wiki/Billion_laughs Same is mostly true of JSON parsers as well of course. If you let potentially hostile users feed arbitrary data into any of these, even a totally non-buggy, perfectly conformant parser is wide-open to be…

Somehow I'm surprised that XML/JSON libraries written since the 90s would have the same core flaw as string libraries written in the 70s.

I know I shouldn't be. But here I am, surprised.