Topic: XML flaws threaten 'enormous' array of apps (ASLR, DEP, NX bits, canaries...)

[Samker]

Security researchers have uncovered critical flaws in open-source software that implements the Extensible Markup Language in a staggering array of applications used by banks, e-commerce websites, and consumers.

The bugs uncovered by researchers at Finland-based Codenomicon were contained in virtually every open-source XML library available, Ari Takanen, CTO of Finland-based security testing firm Codenomicon, told The Register. Many of them could allow attackers to crash machines running applications that use the libraries or even remotely execute malicious code. The Python and Java programming languages and Apache Xerces are already known to be affected, and Takanen said many more could be as well.

"The number of applications can be enormous," Takanen said. "Basically, any application or piece of software that's using XML libraries is vulnerable."

The discovery is significant because it highlights holes in the foundation upon which many of the world's applications are built. The programs drive cloud computing services, 3-dimensional programs, and a wide range of business software.

The discovery is the result of a program dubbed CROSS, or Codenomicon Robust Open Source Software, which uses software fuzzers to test the security of open-source programs by throwing manipulated data at them and seeing how they react. Codenomicon researchers tested every open-source library and all were found to contain vulnerabilities, though their severity varied from library to library.

Codenomicon said here that libraries built on the C language are at highest risk because exploits can include the execution attacks: http://www.codenomicon.com/labs/xml/

"Unfortunately, most libraries out there are written in C, and thus errors such as stack overflows are not that uncommon," the document stated. "When this is the case, exploitability depends on the anti-exploitation features of the platform (ASLR, DEP, NX bits, canaries etc.)."

C-based libraries used in communications software represent the highest risk because attacks could include remote execution. Libraries that merely process files are most likely vulnerable to only local attacks. The bugs could be exploited by tricking a user into opening a booby-trapped XML file or by sending malicious requests to XML-powered Web services.

Codenomicon has shared its finding with the Computer Emergency Readiness Team of Finland, which is reaching out to software makers who may have embedded the libraries in their offerings or used the libraries to help develop their programs. The Python Software Foundation is working on a fix, according to this CERT advisory: https://www.cert.fi/en/reports/2009/vulnerability2009085.html
There was no information about Sun and Apache, but those outfits are expected to be working on fixes as well, according to Codenomicon.

The discovery is reminiscent of a vulnerability many of the Codenomicon principals found in 2001 and 2002 in a networking standard known as ASN.1. The ramifications of the bug were serious enough to lead of months of wrangling by hundreds of companies that relied on the technology and to warrant a briefing of then President George W. Bush.

It's impossible to know now if the flaws uncovered in XML will be as far reaching as all that. But if you value your organization's security, it might be a good idea to monitor the providers of your libraries to see what they have to say.

(Register)