Re: [xml] [xml]security issues

[Aleksey Sanin <aleksey aleksey com>]

I've commited the fix (all sprintf() calls replaced with  snprintf()). I
will 
also try to do a broader security code review this weekend (thanks for 
idea, Anju!). If anyone is interested please join me! 


Aleksey.



Aleksey Sanin wrote:

Hi, Anju!

You are absolutelly right about sprintf() function and I'll replace it with
snprintf() if there is no objections from others. xmllint is a standalone example
application and a buffer overflow in it not actually dangerouse but someone can
decide to call it from CGI script :)
Regarding the environment variables for FTP/HTTP access:
the networking code in LibXML is only an example. Any real application will likely
use its own code to access remote files. And I also have to say that if "bad guy"
can change your environment variables then you are in a big trouble :)


Aleksey

Anju Premachandran wrote:

Hello All
I am doing a security audit on gnome-xml.
I saw a buffer-overflow in xmllint.c in xmlHTMLPrintFileInfo( ).There is a sprintf( ) function which copies the filename to a buffer of 50,000.
Since the filename can be non-local URI ,this can turn out be a vulnerability.

Also in nanoftp.c in xmlNanoFTPInit( ) there is a getenv( ) call to the environment variable "ftp_proxy_password" from where the proxy password is obtained.
Can this be a security issue?
Also the library depends on environment variables to get HTTP and FTP proxy URLs.Can these turn out to be security concerns?

Expecting your valuable feedbacks

Regards
Anju


  

**************************Disclaimer**************************************************    
 
 Information contained in this E-MAIL being proprietary to Wipro Limited is 'privileged' 
and 'confidential' and intended for use only by the individual or entity to which it is 
addressed. You are notified that any use, copying or dissemination of the information 
contained in the E-MAIL in any manner whatsoever is strictly prohibited.

****************************************************************************************