Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 13 Jan 2012 13:50:59 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Nicolas Grégoire <nicolas.gregoire@...rri.fr>
Subject: Re: CVE affected for PHP 5.3.9 ?

On 01/13/2012 11:08 AM, Nicolas Grégoire wrote:
> Le vendredi 13 janvier 2012 à 09:54 -0700, Kurt Seifried a écrit :
>> I'm not clear on how this crosses a security boundary
> Some applications *will* process untrusted XSLT stylesheets.
>
> The most basic example is online XSLT gateways :
> http://www.shell-tools.net/index.php?op=xslt
> http://online-toolz.com/tools/xslt-transformation.php
>
> You may find more with Google and a dork like [inurl:php
> inurl:"xsl=http"]. This is often used to adapt the layout of a page to
> the browser (desktop vs. mobile).
>
> There's too some more complex cases where untrusted XSLT may be used,
> like parsing SVG images, XML-DSig signatures or SAML tokens, ...
>
> Regards,
> Nicolas
>
>
Ok I'm still not clear on what the security claim is. Are you saying you
can cause arbitrary text output via XSL/XML mangling tricks? And
combined with having a script that uses something like "<sax:output
href="0wn3d.php" method="text">" you can put arbitrary text content into
this file which could then result in the file being parsed? The problem
is you'd have to write a script that does this, writes to a local file
with a file ending in .php or .shtml or whatever, in which case it's
pretty clear the script writer MEANT to do that. Again I'm still not
clear on what/how a security boundary is being crossed. How does this
elevate privileges or give you remote access that you wouldn't already
if you can upload arbitrary PHP scripts?

-- 

-- Kurt Seifried / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ