[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <542CF50E.7060001@redhat.com>
Date: Thu, 02 Oct 2014 00:47:42 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: Remote code execution via XSL extensions
in SpagoBI
Just to confirm this isn't a troll ;) despite a scary sounding
contributor agreement SpagoBI is Open Source:
http://www.spagoworld.org/xwiki/bin/view/SpagoBI/OpenSource
On 02/10/14 12:40 AM, David Jorm wrote:
> Hi All
>
> Can a CVE ID please be assigned for part 1) of this issue:
>
> https://www.spagoworld.org/jira/browse/SPAGOBI-1885
>
> Anyone who has permission to define a document that uses the
> accessibility engine can supply an XSL file that will be used to
> transform the data in the presentation view. SpagoBI is using Xalan to
> perform the transformation, and there's two problems:
>
> 1) FEATURE_SECURE_PROCESSING is not set. This means an attacker can
> provide an XSL document with embedded Java code, which will be executed
> on the server.
>
> 2) SpagoBI is using Xalan 2.6.0. A flaw in this version means that if
> with FEATURE_SECURE_PROCESSING set, an attacker can bypass the
> restrictions, and provide XSL documents with embedded Java code. To
> address this, you need to upgrade to >= 2.7.2:
>
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0107
>
> I have provided a reproducer to the developers via email.
>
> Thanks
> --
> David Jorm / Red Hat Product Security
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
