Re: [xml] [xml]security issues

Hi, Anju!

You are absolutelly right about sprintf() function and I'll replace it with
snprintf() if there is no objections from others. xmllint is a standalone example
application and a buffer overflow in it not actually dangerouse but someone can
decide to call it from CGI script :)
Regarding the environment variables for FTP/HTTP access:
the networking code in LibXML is only an example. Any real application will likely
use its own code to access remote files. And I also have to say that if "bad guy"
can change your environment variables then you are in a big trouble :)


Anju Premachandran wrote:
Hello All
I am doing a security audit on gnome-xml.
I saw a buffer-overflow in xmllint.c in xmlHTMLPrintFileInfo( ).There is a sprintf( ) function which copies the filename to a buffer of 50,000.
Since the filename can be non-local URI ,this can turn out be a vulnerability.

Also in nanoftp.c in xmlNanoFTPInit( ) there is a getenv( ) call to the environment variable "ftp_proxy_password" from where the proxy password is obtained.
Can this be a security issue?
Also the library depends on environment variables to get HTTP and FTP proxy URLs.Can these turn out to be security concerns?

Expecting your valuable feedbacks



**************************Disclaimer************************************************** Information contained in this E-MAIL being proprietary to Wipro Limited is 'privileged' and 'confidential' and intended for use only by the individual or entity to which it is addressed. You are notified that any use, copying or dissemination of the information contained in the E-MAIL in any manner whatsoever is strictly prohibited. ****************************************************************************************

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]