Feeds

XML flaws threaten 'enormous' array of apps

Java, Python, and Apache - for starters

Securing Web Applications Made Simple and Scalable

Updated Security researchers have uncovered critical flaws in open-source software that implements the Extensible Markup Language in a staggering array of applications used by banks, e-commerce websites, and consumers.

The bugs uncovered by researchers at Finland-based Codenomicon were contained in virtually every open-source XML library available, Ari Takanen, CTO of Finland-based security testing firm Codenomicon, told The Register. Many of them could allow attackers to crash machines running applications that use the libraries or even remotely execute malicious code. The Python and Java programming languages and Apache Xerces are already known to be affected, and Takanen said many more could be as well.

"The number of applications can be enormous," Takanen said. "Basically, any application or piece of software that's using XML libraries is vulnerable."

The discovery is significant because it highlights holes in the foundation upon which many of the world's applications are built. The programs drive cloud computing services, 3-dimensional programs, and a wide range of business software.

The discovery is the result of a program dubbed CROSS, or Codenomicon Robust Open Source Software, which uses software fuzzers to test the security of open-source programs by throwing manipulated data at them and seeing how they react. Codenomicon researchers tested every open-source library and all were found to contain vulnerabilities, though their severity varied from library to library.

The bugs "are related to the parsing of XML elements with unexpected byte values and recursive parentheses, which cause the program to access memory out of bounds, or to loop indefinitely," according to this advisory from the Computer Emergency Response Team in Finland, which has been working with Codenomicon to coordinate fixes among different software providers.

Codenomicon went on to say here that libraries built on the C language are at highest risk because exploits can include the execution attacks.

"Unfortunately, most libraries out there are written in C, and thus errors such as stack overflows are not that uncommon," the document stated. "When this is the case, exploitability depends on the anti-exploitation features of the platform (ASLR, DEP, NX bits, canaries etc.)."

C-based libraries used in communications software represent the highest risk because attacks could include remote execution. Libraries that merely process files are most likely vulnerable to only local attacks. The bugs could be exploited by tricking a user into opening a booby-trapped XML file or by sending malicious requests to XML-powered Web services.

CERT Finland continues to reach out to software makers who may have embedded the libraries in their offerings or used the libraries to help develop their programs. The Python Software Foundation is working on a fix, CERT said.

Sun issued at least two XML-related updates, one for OpenSSO Enterprise 8.0 Sun Java System Access Manager and the other in its Java Runtime Environment. The status of Apache Xerces remained unclear, although the foundation issued this patch in June that references Codenomicon.

The discovery is reminiscent of a vulnerability many of the Codenomicon principals found in 2001 and 2002 in a networking standard known as ASN.1. The ramifications of the bug were serious enough to lead of months of wrangling by hundreds of companies that relied on the technology and to warrant a briefing of then President George W. Bush.

It's impossible to know now if the flaws uncovered in XML will be as far reaching as all that. But if you value your organization's security, it might be a good idea to monitor the providers of your libraries to see what they have to say. ®

Story updated to add details about bug and fixes from Sun and Apache.

The smart choice: opportunity from uncertainty

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.