REDHAT-BUG-461015: Buffer Overflow

Q: Which deployments are most likely to be exposed?

Systems that parse attacker-controlled XML containing unusually long entity names are exposed, particularly when the entity name is emitted unchanged rather than substituted with its entity value.

Q: What input is required to trigger the issue?

An attacker needs to provide XML that reaches libxml2's xmlParseAttValueComplex() handling and uses a long entity name under the affected non-substitution behavior. The resulting condition is a heap buffer overflow.

Q: What version contains the upstream fix?

The issue was fixed upstream in libxml2 version 2.7.0. Use the version supplied by your vendor to determine whether the deployed package includes that upstream fix.

Published Sep 3, 2008

Updated

It was discovered, that libxml2 does not properly handle long XML entity names. In the xmlParseAttValueComplex() function in parser.c, when entity name is not substituted with entity value, but is sent to output unchanged, buffer used to store entity name may not be grown sufficiently in case of long entity names, resulting in a heap buffer overflow.

Issue is already fixed upstream in version 2.7.0.

Affected Software

1 affected component

XMLSoft Libxml2<2.7.0

Event History

Sep 3, 2008

Data Sourced

via Red Hat·02:29 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are most likely to be exposed?

Systems that parse attacker-controlled XML containing unusually long entity names are exposed, particularly when the entity name is emitted unchanged rather than substituted with its entity value.

What input is required to trigger the issue?

An attacker needs to provide XML that reaches libxml2's xmlParseAttValueComplex() handling and uses a long entity name under the affected non-substitution behavior. The resulting condition is a heap buffer overflow.

What version contains the upstream fix?