Major security holes in popular XML libraries

Summary: A security research outfit has issued a warning for several critical vulnerabilities in popular XML libraries used by a wide range of software vendors.The flaws, discovered earlier this year by Codenomicon, affect a wide range of technology products, including servers and server applications, workstations and end user applications, network devices,  embedded systems and mobile devices.

A security research outfit has issued a warning for several critical vulnerabilities in popular XML libraries used by a wide range of software vendors.

The flaws, discovered earlier this year by Codenomicon, affect a wide range of technology products, including servers and server applications, workstations and end user applications, network devices,  embedded systems and mobile devices. Vendors affected include Sun Microsystems, the Apache Software Foundation and Python.

Here's the skinny from Finland's Computer Emergency Response Team (CERT-FI):

The vulnerabilities are related to the parsing of XML elements with unexpected byte values and recursive parentheses, which cause the program to access memory out of bounds, or to loop indefinitely. The effects of the vulnerabilities include denial of service and potentially code execution. The vulnerabilities can be exploited by enticing a user to open a specially modified file, or by submitting it to a server that handles XML content.

The vulnerabilities can be triggered remotely and, in some cases (Python), remain unpatched.

* Image source: http://www.ibridge.be.

Topics: Servers, Security, Software Development

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

13 comments
Log in or register to join the discussion
  • Open Source Secure

    So much for Open Source software being secure. I thought that with all those developers looking at the code it was ment to be more secure than closed software.
    KillBitX
  • Superior peer-reviewed software

    ... strikes out again. Of course the fanboys will somehow manage to spin it so that M$ is at fault.

    Repeat after me, software written in mom's basement might be free, but that's it's only virtue.
    croberts
    • Machine code

      Don't leave home without it.
      Barklessdog
  • LMAO

    Boy you MS fanboys above couldn't wait could you? I guess you have to jump quick when something appears to be found in a OSS project since its pretty rare as compared to the hole riddled software released by your favorite company. What really sad is if folk are running the affected libraries on Windows where they are sure to be free to cause all sorts of damage.
    storm14k
    • No, what's really sad

      is that the many eyes myth is exposed again for the myth that it is.
      Joeman57
      • RE: No, what's really sad

        Isn't the "many eyes myth" how this flaw was found?

        Sounds pretty real to me.

        pwn0tr0n
  • OMG. Sandbox I said!

    nt
     Dietrich T. Schmitz
    • Litterbox is a better term i think :)

      nt
      Joeman57
    • Agreed, sandbox!

      Statistics show that open source and smaller ISV software experience more vulnerabilities than the "top" commercial ones. (read the IBM X-Force 2008 trends report).

      However, vulnerabilities happens in all software, commercial or open source. It really has very little to do with the development model and everything to do with the QA policies in place. Cue Microsofts SDL which is now widely regarded as a state-of-the-art security-oriented development model.

      But as vulnerabilities WILL happen we need defense in-depth.

      If you are running Linux then use Apparmor. Spend some time tweaking those profiles.

      If you are running Windows Vista / 7 <i>leave UAC switched on</i> as disabling UAC will ALSO disable the IE7/8 sandbox. Consider using Chrome which has a better security track record and ALSO has a sandbox,

      If you are running OSX, well, there's really not much you can do. While OSX does have "some" sandbox capability, it is flawed, ineffective and not even enabled for the apps where it makes the most sense.

      Regardless of operating system, uninstall features/applications (especially Java versions) you don't use.

      Regardless of operating system, keep your system up-to-date.
      honeymonster
  • if only

    This would be a good place to have a thoughtful discussion of the issues; instead we get knee-jerk reactions that aren't of any use.
    You're probably intelligent people, possibly professionals. How about acting like it?
    krkosska
    • Probability

      A quick look at any of the ZDNet polls would suggest the readership is neither intelligent nor professional. Linux and Apple fanbois (as distinct from professional users) predominate, whereas in the real world, 93% use Windows.

      So on top of the rabid geek/lifestyle majority you also have ZDNet paying the bloggers by the amount of posts they attract. This of course leads to plenty of troll blogs (that can be characterised by a "Windows Sux" headline) to attract as many intemperate posts as possible.

      So if you are looking for intelligent professional discussion, you won't find it here ;-)
      tonymcs@...
  • Ubuntu released 4 patches for XML today

    Ubuntu released 4 patches for XML today, Did notice that thee was mention of Apache, hope these fixed it!! I am neither a professional or a Fanboy! Just a user that got fed up with Microsoft updates breaking my machine! Have been with Ubuntu since 7,04! Doubt I will go back to Microsoft any time soon!!
    leopards
  • RE: Major security holes in popular XML libraries

    Well done! Thank you very much for professional templates and community edition
    <a href="http://www.yuregininsesi.com">seslisohbet</a> <a href="http://www.yuregininsesi.com">seslichat</a>
    birumut