RE: [xml] [xml]security issues

["Anju Premachandran" <anju premachandran wipro com>]

hey great!!
I will be always there.I have seen the code a bit.
I will look in more detail and inform u if i get more issues.

Regards
Anju

-----Original Message-----
From:	Aleksey Sanin [mailto:aleksey aleksey com]
Sent:	Fri 6/14/2002 10:42 PM
To:	Aleksey Sanin
Cc:	Anju Premachandran; xml gnome org
Subject:	Re: [xml] [xml]security issues

I've commited the fix (all sprintf() calls replaced with  snprintf()). I 
will
also try to do a broader security code review this weekend (thanks for
idea, Anju!). If anyone is interested please join me!


Aleksey.



Aleksey Sanin wrote:

> Hi, Anju!
>
> You are absolutelly right about sprintf() function and I'll replace it 
> with
> snprintf() if there is no objections from others. xmllint is a 
> standalone example
> application and a buffer overflow in it not actually dangerouse but 
> someone can
> decide to call it from CGI script :)
> Regarding the environment variables for FTP/HTTP access:
> the networking code in LibXML is only an example. Any real application 
> will likely
> use its own code to access remote files. And I also have to say that 
> if "bad guy"
> can change your environment variables then you are in a big trouble :)
>
>
> Aleksey
>
> Anju Premachandran wrote:
>
>>Hello All
>>I am doing a security audit on gnome-xml.
>>I saw a buffer-overflow in xmllint.c in xmlHTMLPrintFileInfo( ).There is a sprintf( ) function which copies the filename to a buffer of 50,000.
>>Since the filename can be non-local URI ,this can turn out be a vulnerability.
>>
>>Also in nanoftp.c in xmlNanoFTPInit( ) there is a getenv( ) call to the environment variable "ftp_proxy_password" from where the proxy password is obtained.
>>Can this be a security issue?
>>Also the library depends on environment variables to get HTTP and FTP proxy URLs.Can these turn out to be security concerns?
>>
>>Expecting your valuable feedbacks
>>
>>Regards
>>Anju
>>
>>
>>  
>>
>>------------------------------------------------------------------------
>>
>>**************************Disclaimer**************************************************    
>> 
>> Information contained in this E-MAIL being proprietary to Wipro Limited is 'privileged' 
>>and 'confidential' and intended for use only by the individual or entity to which it is 
>>addressed. You are notified that any use, copying or dissemination of the information 
>>contained in the E-MAIL in any manner whatsoever is strictly prohibited.
>>
>>****************************************************************************************
>>  
>>
>




**************************Disclaimer**************************************************    
 
 Information contained in this E-MAIL being proprietary to Wipro Limited is 'privileged' 
and 'confidential' and intended for use only by the individual or entity to which it is 
addressed. You are notified that any use, copying or dissemination of the information 
contained in the E-MAIL in any manner whatsoever is strictly prohibited.

****************************************************************************************