Feeds

XML flaws threaten 'enormous' array of apps

Java, Python, and Apache - for starters

Boost IT visibility and business value

Updated Security researchers have uncovered critical flaws in open-source software that implements the Extensible Markup Language in a staggering array of applications used by banks, e-commerce websites, and consumers.

The bugs uncovered by researchers at Finland-based Codenomicon were contained in virtually every open-source XML library available, Ari Takanen, CTO of Finland-based security testing firm Codenomicon, told The Register. Many of them could allow attackers to crash machines running applications that use the libraries or even remotely execute malicious code. The Python and Java programming languages and Apache Xerces are already known to be affected, and Takanen said many more could be as well.

"The number of applications can be enormous," Takanen said. "Basically, any application or piece of software that's using XML libraries is vulnerable."

The discovery is significant because it highlights holes in the foundation upon which many of the world's applications are built. The programs drive cloud computing services, 3-dimensional programs, and a wide range of business software.

The discovery is the result of a program dubbed CROSS, or Codenomicon Robust Open Source Software, which uses software fuzzers to test the security of open-source programs by throwing manipulated data at them and seeing how they react. Codenomicon researchers tested every open-source library and all were found to contain vulnerabilities, though their severity varied from library to library.

The bugs "are related to the parsing of XML elements with unexpected byte values and recursive parentheses, which cause the program to access memory out of bounds, or to loop indefinitely," according to this advisory from the Computer Emergency Response Team in Finland, which has been working with Codenomicon to coordinate fixes among different software providers.

Codenomicon went on to say here that libraries built on the C language are at highest risk because exploits can include the execution attacks.

"Unfortunately, most libraries out there are written in C, and thus errors such as stack overflows are not that uncommon," the document stated. "When this is the case, exploitability depends on the anti-exploitation features of the platform (ASLR, DEP, NX bits, canaries etc.)."

C-based libraries used in communications software represent the highest risk because attacks could include remote execution. Libraries that merely process files are most likely vulnerable to only local attacks. The bugs could be exploited by tricking a user into opening a booby-trapped XML file or by sending malicious requests to XML-powered Web services.

CERT Finland continues to reach out to software makers who may have embedded the libraries in their offerings or used the libraries to help develop their programs. The Python Software Foundation is working on a fix, CERT said.

Sun issued at least two XML-related updates, one for OpenSSO Enterprise 8.0 Sun Java System Access Manager and the other in its Java Runtime Environment. The status of Apache Xerces remained unclear, although the foundation issued this patch in June that references Codenomicon.

The discovery is reminiscent of a vulnerability many of the Codenomicon principals found in 2001 and 2002 in a networking standard known as ASN.1. The ramifications of the bug were serious enough to lead of months of wrangling by hundreds of companies that relied on the technology and to warrant a briefing of then President George W. Bush.

It's impossible to know now if the flaws uncovered in XML will be as far reaching as all that. But if you value your organization's security, it might be a good idea to monitor the providers of your libraries to see what they have to say. ®

Story updated to add details about bug and fixes from Sun and Apache.

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?