Bug 705869 (CVE-2011-3600)

Do you know if there's a test or a way for us to determine if this is present in 3.0, Vincent?  Thanks.

Andrew, I don't.  I've been unable to find any information on this issue beyond the above (was notified of its existence by a Gentoo bug).  I wish I could find the JIRA and a patch, but I've been unable to find that yet.

[rcvalle@localhost xmlrpc]$ svn diff -r r906431:r906432
Index: src/changes/changes.xml
===================================================================
--- src/changes/changes.xml	(revision 906431)
+++ src/changes/changes.xml	(revision 906432)
@@ -37,6 +37,10 @@
       <action dev="jochen" type="add" due-to="Gam" due-to-email="gamaliel">
         Added support for configured timeouts to the XmlRpcSun15HttpTransport class.
       </action>
+      <action dev="jochen" type="fix" due-to="Johan H&#244;gre" due-to-email="johan.hagre">
+        Fixed a potential security hole: The client has been able to include server side resources
+        into the request by using external entities.
+      </action>
     </release>
 
     <release version="3.1.2" date="2009-Apr-19">
Index: common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java
===================================================================
--- common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java	(revision 906431)
+++ common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java	(revision 906432)
@@ -34,6 +34,20 @@
 		spf = SAXParserFactory.newInstance();
 		spf.setNamespaceAware(true);
 		spf.setValidating(false);
+		try {
+		    spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
+		} catch (javax.xml.parsers.ParserConfigurationException e) {
+		    // Ignore it
+        } catch (org.xml.sax.SAXException e) {
+            // Ignore it
+		}
+		try {
+		    spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+        } catch (javax.xml.parsers.ParserConfigurationException e) {
+            // Ignore it
+        } catch (org.xml.sax.SAXException e) {
+            // Ignore it
+		}
 	}
 
 	/** Creates a new instance of {@link XMLReader}.
Index: pom.xml
===================================================================
--- pom.xml	(revision 906431)
+++ pom.xml	(revision 906432)
@@ -187,6 +187,10 @@
       <email>markg</email>
     </contributor>
     <contributor>
+      <name>Johan H&#244;gre</name>
+      <email>johan.hagre</email>
+    </contributor>
+    <contributor>
       <name>Catalin Hritcu</name>
       <email>Catalin.Hritcu</email>
     </contributor>
[rcvalle@localhost xmlrpc]$

Original report:
http://old.nabble.com/-PATCH--Setting-SAX-features-for-XML-RPC-td27435656.html
http://marc.info/?t=126520065900003&r=1&w=2

According to the reporter, for the information exposure happen, the error message generated should be included in the response by the application. Thus, decreasing the security impact of this issue.

This issue did not affect the versions of xmlrpc3 as shipped with Fedora 13, 14, and 15.

http://pkgs.fedoraproject.org/gitweb/?p=xmlrpc3.git;a=blob;f=sources;h=f4bbd2cc749e255e07c11eca020ae75122168651;hb=refs/heads/f13
http://pkgs.fedoraproject.org/gitweb/?p=xmlrpc3.git;a=blob;f=sources;h=f4bbd2cc749e255e07c11eca020ae75122168651;hb=refs/heads/f14
http://pkgs.fedoraproject.org/gitweb/?p=xmlrpc3.git;a=blob;f=sources;h=f4bbd2cc749e255e07c11eca020ae75122168651;hb=refs/heads/f15

(In reply to comment #7)
> This issue did not affect the versions of xmlrpc3 as shipped with Fedora 13,
> 14, and 15.

I thinks is supposed to say current Fedora is not affected because it's already upgraded to fixed 3.1.3 version.  That's not the case, F13 (EOL now) and F14 still have 3.0, see:

http://pkgs.fedoraproject.org/gitweb/?p=xmlrpc3.git;a=blob;f=sources;hb=f13
http://pkgs.fedoraproject.org/gitweb/?p=xmlrpc3.git;a=blob;f=sources;hb=f14

(In reply to comment #9)
> (In reply to comment #7)
> > This issue did not affect the versions of xmlrpc3 as shipped with Fedora 13,
> > 14, and 15.
> 
> I thinks is supposed to say current Fedora is not affected because it's already
> upgraded to fixed 3.1.3 version.  That's not the case, F13 (EOL now) and F14
> still have 3.0, see:
> 
> http://pkgs.fedoraproject.org/gitweb/?p=xmlrpc3.git;a=blob;f=sources;hb=f13
> http://pkgs.fedoraproject.org/gitweb/?p=xmlrpc3.git;a=blob;f=sources;hb=f14

Thanks for the correction Tomas.

Created xmlrpc3 tracking bugs for this issue

Affects: fedora-14 [bug 744364]

Statement:

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.