[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <200910280002.45177.tmb@65535.com>
Date: Wed, 28 Oct 2009 00:02:40 +0000
From: Tim Brown <tmb@...35.com>
To: oss-security@...ts.openwall.com
Subject: Handling cases of CWE-776
All,
How are problems with XML bombs (the so called "billion laughs" attack) being
handled? Should I be filing such bugs against the applications that exposes
the XML parser to user input or is it better to report the issue against the
parser themselves. For example, the test case I've prepared for one affected
parser simply causes the CPU to spin but the system appears to stay
responsive (so far ;)). Is it even fair to call such a denial of service?
(If the code was executed in a real application, no further processing would
happen within the affected process as the parser is tied up in memmove()s).
I'm just curious as I don't want to waste peoples time with the disclosure
process if others are simply filing "standard" bugs against affected parsers
and moving on to more interesting matters.
Cheer,
Tim
--
Tim Brown
<mailto:tmb@...35.com>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
