The changelog for XML-RPC 3.1.3 [1] indicates: Fixed a potential security hole: The client has been able to include server side resources into the request by using external entities. Thanks to Johan Hôgre. I have been unable to find where the fix is (no JIRA noted so cannot find a commit), so it is unclear whether this affects 3.0 or if this was introduced in 3.1.x at some point. [1] http://ws.apache.org/xmlrpc/changes-report.html#a3.1.3
Do you know if there's a test or a way for us to determine if this is present in 3.0, Vincent? Thanks.
Andrew, I don't. I've been unable to find any information on this issue beyond the above (was notified of its existence by a Gentoo bug). I wish I could find the JIRA and a patch, but I've been unable to find that yet.
[rcvalle@localhost xmlrpc]$ svn diff -r r906431:r906432 Index: src/changes/changes.xml =================================================================== --- src/changes/changes.xml (revision 906431) +++ src/changes/changes.xml (revision 906432) @@ -37,6 +37,10 @@ <action dev="jochen" type="add" due-to="Gam" due-to-email="gamaliel"> Added support for configured timeouts to the XmlRpcSun15HttpTransport class. </action> + <action dev="jochen" type="fix" due-to="Johan Hôgre" due-to-email="johan.hagre"> + Fixed a potential security hole: The client has been able to include server side resources + into the request by using external entities. + </action> </release> <release version="3.1.2" date="2009-Apr-19"> Index: common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java =================================================================== --- common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java (revision 906431) +++ common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java (revision 906432) @@ -34,6 +34,20 @@ spf = SAXParserFactory.newInstance(); spf.setNamespaceAware(true); spf.setValidating(false); + try { + spf.setFeature("http://xml.org/sax/features/external-general-entities", false); + } catch (javax.xml.parsers.ParserConfigurationException e) { + // Ignore it + } catch (org.xml.sax.SAXException e) { + // Ignore it + } + try { + spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + } catch (javax.xml.parsers.ParserConfigurationException e) { + // Ignore it + } catch (org.xml.sax.SAXException e) { + // Ignore it + } } /** Creates a new instance of {@link XMLReader}. Index: pom.xml =================================================================== --- pom.xml (revision 906431) +++ pom.xml (revision 906432) @@ -187,6 +187,10 @@ <email>markg</email> </contributor> <contributor> + <name>Johan Hôgre</name> + <email>johan.hagre</email> + </contributor> + <contributor> <name>Catalin Hritcu</name> <email>Catalin.Hritcu</email> </contributor> [rcvalle@localhost xmlrpc]$
Original report: http://old.nabble.com/-PATCH--Setting-SAX-features-for-XML-RPC-td27435656.html http://marc.info/?t=126520065900003&r=1&w=2
According to the reporter, for the information exposure happen, the error message generated should be included in the response by the application. Thus, decreasing the security impact of this issue.
This issue did not affect the versions of xmlrpc3 as shipped with Fedora 13, 14, and 15. http://pkgs.fedoraproject.org/gitweb/?p=xmlrpc3.git;a=blob;f=sources;h=f4bbd2cc749e255e07c11eca020ae75122168651;hb=refs/heads/f13 http://pkgs.fedoraproject.org/gitweb/?p=xmlrpc3.git;a=blob;f=sources;h=f4bbd2cc749e255e07c11eca020ae75122168651;hb=refs/heads/f14 http://pkgs.fedoraproject.org/gitweb/?p=xmlrpc3.git;a=blob;f=sources;h=f4bbd2cc749e255e07c11eca020ae75122168651;hb=refs/heads/f15
(In reply to comment #7) > This issue did not affect the versions of xmlrpc3 as shipped with Fedora 13, > 14, and 15. I thinks is supposed to say current Fedora is not affected because it's already upgraded to fixed 3.1.3 version. That's not the case, F13 (EOL now) and F14 still have 3.0, see: http://pkgs.fedoraproject.org/gitweb/?p=xmlrpc3.git;a=blob;f=sources;hb=f13 http://pkgs.fedoraproject.org/gitweb/?p=xmlrpc3.git;a=blob;f=sources;hb=f14
(In reply to comment #9) > (In reply to comment #7) > > This issue did not affect the versions of xmlrpc3 as shipped with Fedora 13, > > 14, and 15. > > I thinks is supposed to say current Fedora is not affected because it's already > upgraded to fixed 3.1.3 version. That's not the case, F13 (EOL now) and F14 > still have 3.0, see: > > http://pkgs.fedoraproject.org/gitweb/?p=xmlrpc3.git;a=blob;f=sources;hb=f13 > http://pkgs.fedoraproject.org/gitweb/?p=xmlrpc3.git;a=blob;f=sources;hb=f14 Thanks for the correction Tomas.
Created xmlrpc3 tracking bugs for this issue Affects: fedora-14 [bug 744364]
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.