Date: Fri, 13 Jan 2012 13:50:59 -0700 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Nicolas Grégoire <nicolas.gregoire@...rri.fr> Subject: Re: CVE affected for PHP 5.3.9 ? On 01/13/2012 11:08 AM, Nicolas Grégoire wrote: > Le vendredi 13 janvier 2012 à 09:54 -0700, Kurt Seifried a écrit : >> I'm not clear on how this crosses a security boundary > Some applications *will* process untrusted XSLT stylesheets. > > The most basic example is online XSLT gateways : > http://www.shell-tools.net/index.php?op=xslt > http://online-toolz.com/tools/xslt-transformation.php > > You may find more with Google and a dork like [inurl:php > inurl:"xsl=http"]. This is often used to adapt the layout of a page to > the browser (desktop vs. mobile). > > There's too some more complex cases where untrusted XSLT may be used, > like parsing SVG images, XML-DSig signatures or SAML tokens, ... > > Regards, > Nicolas > > Ok I'm still not clear on what the security claim is. Are you saying you can cause arbitrary text output via XSL/XML mangling tricks? And combined with having a script that uses something like "<sax:output href="0wn3d.php" method="text">" you can put arbitrary text content into this file which could then result in the file being parsed? The problem is you'd have to write a script that does this, writes to a local file with a file ending in .php or .shtml or whatever, in which case it's pretty clear the script writer MEANT to do that. Again I'm still not clear on what/how a security boundary is being crossed. How does this elevate privileges or give you remote access that you wouldn't already if you can upload arbitrary PHP scripts? -- -- Kurt Seifried / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ