oss-security - Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140603152747.GT23760@sentinelchicken.org>
Date: Tue, 3 Jun 2014 08:27:47 -0700
From: Tim <tim-security@...tinelchicken.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2014-0191 libxml2: external parameter entity
 loaded when entity substitution is disabled


Hi Tomas,

Thanks for looking into this.  Sorry for the slow reply. 


> As far as I can see setExpandEntityReferences() controls what value is
> set for the create-entity-ref-nodes DOM parser feature:
> 
> http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/file/cae04d181428/src/com/sun/org/apache/xerces/internal/jaxp/DocumentBuilderImpl.java#l158
> http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/file/cae04d181428/src/com/sun/org/apache/xerces/internal/jaxp/DocumentBuilderImpl.java#l74
> http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/file/cae04d181428/src/com/sun/org/apache/xerces/internal/impl/Constants.java#l427
> 
> The description in Java API docs is rather brief, xerces docs have more
> details:
> 
> http://xerces.apache.org/xerces-j/features.html#create-entity-ref-nodes
> http://xerces.apache.org/xerces2-j/features.html#dom.create-entity-ref-nodes
> 
> AFAICS, the feature does not aim to control if entity references are
> expanded, but only how exactly they appear in the resulting DOM tree.

Ok, that makes sense.  Of course it is pointless for security if it
doesn't affect parameter entities.  I also find it odd that one of the
only standard methods available to directly tweak entity behavior can
only be implemented by setting a feature in Xerces that is
non-standard.


> Maybe your paper should rather mention parser features as
> external-general-entities and external-parameter-entities:
> 
> http://docs.oracle.com/javase/7/docs/api/org/xml/sax/package-summary.html#package_description

I do mention the specific features that one needs to disable in order
to make parsing safe.  However, I didn't realize that that some of
these features were standardized.  Still, it would be quite confusing
to any developer that doesn't spend extensive amounts of time
researching each XML feature and understanding what needs to be turned
off.


> OWASP XXE document covers some of this, but actually mentions only one
> of the two features...
> 
> https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing#Java

I did end up releasing my paper recently, which I believe has
up-to-date recommendations for Xerces:
  http://vsecurity.com/download/papers/XMLDTDEntityAttacks.pdf


Best,
tim

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.