[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4F109933.30407@redhat.com>
Date: Fri, 13 Jan 2012 13:50:59 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Nicolas Grégoire <nicolas.gregoire@...rri.fr>
Subject: Re: CVE affected for PHP 5.3.9 ?
On 01/13/2012 11:08 AM, Nicolas Grégoire wrote:
> Le vendredi 13 janvier 2012 à 09:54 -0700, Kurt Seifried a écrit :
>> I'm not clear on how this crosses a security boundary
> Some applications *will* process untrusted XSLT stylesheets.
>
> The most basic example is online XSLT gateways :
> http://www.shell-tools.net/index.php?op=xslt
> http://online-toolz.com/tools/xslt-transformation.php
>
> You may find more with Google and a dork like [inurl:php
> inurl:"xsl=http"]. This is often used to adapt the layout of a page to
> the browser (desktop vs. mobile).
>
> There's too some more complex cases where untrusted XSLT may be used,
> like parsing SVG images, XML-DSig signatures or SAML tokens, ...
>
> Regards,
> Nicolas
>
>
Ok I'm still not clear on what the security claim is. Are you saying you
can cause arbitrary text output via XSL/XML mangling tricks? And
combined with having a script that uses something like "<sax:output
href="0wn3d.php" method="text">" you can put arbitrary text content into
this file which could then result in the file being parsed? The problem
is you'd have to write a script that does this, writes to a local file
with a file ending in .php or .shtml or whatever, in which case it's
pretty clear the script writer MEANT to do that. Again I'm still not
clear on what/how a security boundary is being crossed. How does this
elevate privileges or give you remote access that you wouldn't already
if you can upload arbitrary PHP scripts?
--
-- Kurt Seifried / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
