Bug 692133 (CVE-2011-1425)

Summary:	CVE-2011-1425 xmlsec1: arbitrary file creation when verifying signatures
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	mvadkert, security-response-team, veillard
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	xmlsec1 1.2.17	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-04-03 20:18:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	692792, 692793, 694123, 694124, 694125, 833997
Bug Blocks:

Description Tomas Hoger 2011-03-30 13:59:25 UTC

Nicolas Grégoire discovered that xmlsec1 can create a file with attacker-specified path name and content when xmlsec1 is used to verify a signature of a specially-crafted XML file specifying XSLT transformation.  This may be used to create or overwrite arbitrary file writeable to the user running xmlsec1.

This issue was addressed upstream via following commit, which disables XSLT read/write by default:
http://git.gnome.org/browse/xmlsec/commit/?id=35eaacde6093d6711339754fc2146341b8b9f5fa

Acknowledgements:

Red Hat would like to thank Nicolas Grégoire and Aleksey Sanin for reporting this issue.

Comment 2 Tomas Hoger 2011-04-01 06:25:53 UTC

Public now via xmlsec upstream release 1.2.17:
  http://www.aleksey.com/pipermail/xmlsec/2011/009120.html

Comment 3 Tomas Hoger 2011-04-01 07:46:02 UTC

Created xmlsec1 tracking bugs for this issue

Affects: fedora-all [bug 692792]
Affects: epel-6 [bug 692793]

Comment 7 errata-xmlrpc 2011-05-04 21:36:53 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2011:0486 https://rhn.redhat.com/errata/RHSA-2011-0486.html