News
Vigil@nce - expat: denial of service via entities
March 2013 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can transmit malicious XML data to an application
linked to expat, in order to force it to allocate large memory
resources.
Impacted products: Unix (platform)
Severity: 2/4
Creation date: 22/02/2013
DESCRIPTION OF THE VULNERABILITY
The expat library processes XML data.
An XML entity (such as "&abc;") is used to define an alias of a
text string.
However, if the same large entity is called several thousand times
in an XML document, the library consumes numerous resources to
store the XML tree.
An attacker can therefore transmit malicious XML data to an
application linked to expat, in order to force it to allocate
large memory resources.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/expat-denial-of-service-via-entities-12450
