Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 5

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: Wolfgang Hoschek <wolfgang.hoschek AT mac.com>
  • To: Elliotte Harold <elharo AT metalab.unc.edu>
  • Cc: Jeff Williams <jeff.williams AT aspectsecurity.com>, xom-interest AT lists.ibiblio.org
  • Subject: Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 5
  • Date: Mon, 11 Dec 2006 17:47:43 -0800

On Dec 11, 2006, at 1:36 PM, Elliotte Harold wrote:

Jeff Williams wrote:

Gosh, I guess it's impossible to attack anything with XML in it. I'm
going to upgrade my rainbow- and puppy-based security system to "happy
thoughts 2.0", now with XML.

It's certainly not possible to attack any real XML system by using CDATA
unless you can carry out the same attack without using CDATA.

That's a claim with some adhoc reasoning behind it, but not anywhere near a proof. Indeed, I'd be surprised if a credible proof emerged. One day we could see the claim falsified by, say, a buffer overflow exploit specific to CDATA in libxml or some other parser. Again, let me repeat that this isn't about theory and "certainty" but about practise:

An "all or nothing" (e.g. either you let XML in or not) security model is inferior to a multi-layered
model (if layer 1 breaks, there's still layer 2 .. N left as
defense). It's another way of saying that practical security isn't
about making successful attacks impossible (you can't - get over it).
It's about making them as difficult as possible. Talk to folks who
run data centers.


Now if the
system is only pretending to use XML it's a different story.

So what if the parser is better? The point is that it's easy to send
around attacks inside XML that's well-formed and validated.

No, it's not. It's certainly nowhere near as easy as sending an attack
inside a Word file, for example. XML documents and parsers have a
characteristic non-parser based solutions don't. Their behavior is
deterministic.

Unless it isn't defined or well defined. E.g. in the presence of recursive external entities and other bizarre corner cases.

They have well-defined, reliable error behavior.

Unless they have a bug, which they all tend to do, in one way or another.
Again, anectdotal evidence isn't enough to make any claim about definite absence of a security vector.

Look, I'm not avdocating scare mongering, but I'd like to point out that approaching security with a mindset that tries to establish absolute certainty, proof, and the like, is at best a fragile fantasy and at worst a source of (costly) later security problems.

Wolfgang.




Archive powered by MHonArc 2.6.24.

Top of Page