oss-security - Re: CVE Request: libxml2 external parsed entities issue

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1382984271.3170.221.camel@banzai>
Date: Mon, 28 Oct 2013 19:17:51 +0100
From: Nicolas Grégoire <nicolas.gregoire@...rri.fr>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request: libxml2 external parsed entities
 issue

>>libxml2 earlier than 2.9.0 fetches external parsed entities by
>>default, with no way to disable the behaviour.
>>
>>Fixed by the following commit:
>>https://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba017c6b5526070f 

[...]

> Hrm, I would have thought CVE-2013-0339 was for the entities expansion DoS issue
> fixed by this commit:
> 
> https://git.gnome.org/browse/libxml2/commit/?id=23f05e0c33987d6605387b300c4be5da2120a7ab
> 
> The other one is for external entities expansion being enabled by default with
> no way to turn it off. You would lump them together?

It's still unclear to me what exactly CVE-2013-0339 covers.

Patch for the entity expansion DoS:
https://git.gnome.org/browse/libxml2/commit/?id=23f05e0c33987d6605387b300c4be5da2120a7ab

Patch for not expanding external entities by default:
https://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba017c6b5526070f

Are both patches covered? The second one is quite important as it kills
the classic XXE vector <!ENTITY foo SYSTEM "/etc/passwd">

For Ubuntu, CVE-2013-0339 covers the XXE attack.
https://bugs.launchpad.net/ubuntu/%2Bsource/libxml2/%2Bbug/1194410

For Debian, it's "large memory consumption" only:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702260

For RedHat, it covers both but "libxml2 already provides mechanisms to
disable external entities which applications can use. Closing this flaw
as 'wontfix'": https://bugzilla.redhat.com/show_bug.cgi?id=915149

And the official page for the CVE isn't helpful:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0339

Regards,
Nicolas Grégoire

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.