Feeds

XML flaws threaten 'enormous' array of apps

Java, Python, and Apache - for starters

SANS - Survey on application security programs

Updated Security researchers have uncovered critical flaws in open-source software that implements the Extensible Markup Language in a staggering array of applications used by banks, e-commerce websites, and consumers.

The bugs uncovered by researchers at Finland-based Codenomicon were contained in virtually every open-source XML library available, Ari Takanen, CTO of Finland-based security testing firm Codenomicon, told The Register. Many of them could allow attackers to crash machines running applications that use the libraries or even remotely execute malicious code. The Python and Java programming languages and Apache Xerces are already known to be affected, and Takanen said many more could be as well.

"The number of applications can be enormous," Takanen said. "Basically, any application or piece of software that's using XML libraries is vulnerable."

The discovery is significant because it highlights holes in the foundation upon which many of the world's applications are built. The programs drive cloud computing services, 3-dimensional programs, and a wide range of business software.

The discovery is the result of a program dubbed CROSS, or Codenomicon Robust Open Source Software, which uses software fuzzers to test the security of open-source programs by throwing manipulated data at them and seeing how they react. Codenomicon researchers tested every open-source library and all were found to contain vulnerabilities, though their severity varied from library to library.

The bugs "are related to the parsing of XML elements with unexpected byte values and recursive parentheses, which cause the program to access memory out of bounds, or to loop indefinitely," according to this advisory from the Computer Emergency Response Team in Finland, which has been working with Codenomicon to coordinate fixes among different software providers.

Codenomicon went on to say here that libraries built on the C language are at highest risk because exploits can include the execution attacks.

"Unfortunately, most libraries out there are written in C, and thus errors such as stack overflows are not that uncommon," the document stated. "When this is the case, exploitability depends on the anti-exploitation features of the platform (ASLR, DEP, NX bits, canaries etc.)."

C-based libraries used in communications software represent the highest risk because attacks could include remote execution. Libraries that merely process files are most likely vulnerable to only local attacks. The bugs could be exploited by tricking a user into opening a booby-trapped XML file or by sending malicious requests to XML-powered Web services.

CERT Finland continues to reach out to software makers who may have embedded the libraries in their offerings or used the libraries to help develop their programs. The Python Software Foundation is working on a fix, CERT said.

Sun issued at least two XML-related updates, one for OpenSSO Enterprise 8.0 Sun Java System Access Manager and the other in its Java Runtime Environment. The status of Apache Xerces remained unclear, although the foundation issued this patch in June that references Codenomicon.

The discovery is reminiscent of a vulnerability many of the Codenomicon principals found in 2001 and 2002 in a networking standard known as ASN.1. The ramifications of the bug were serious enough to lead of months of wrangling by hundreds of companies that relied on the technology and to warrant a briefing of then President George W. Bush.

It's impossible to know now if the flaws uncovered in XML will be as far reaching as all that. But if you value your organization's security, it might be a good idea to monitor the providers of your libraries to see what they have to say. ®

Story updated to add details about bug and fixes from Sun and Apache.

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.