hey great!! I will be always there.I have seen the code a bit. I will look in more detail and inform u if i get more issues. Regards Anju -----Original Message----- From: Aleksey Sanin [mailto:aleksey aleksey com] Sent: Fri 6/14/2002 10:42 PM To: Aleksey Sanin Cc: Anju Premachandran; xml gnome org Subject: Re: [xml] [xml]security issues I've commited the fix (all sprintf() calls replaced with snprintf()). I will also try to do a broader security code review this weekend (thanks for idea, Anju!). If anyone is interested please join me! Aleksey. Aleksey Sanin wrote:
Hi, Anju! You are absolutelly right about sprintf() function and I'll replace it with snprintf() if there is no objections from others. xmllint is a standalone example application and a buffer overflow in it not actually dangerouse but someone can decide to call it from CGI script :) Regarding the environment variables for FTP/HTTP access: the networking code in LibXML is only an example. Any real application will likely use its own code to access remote files. And I also have to say that if "bad guy" can change your environment variables then you are in a big trouble :) Aleksey Anju Premachandran wrote:Hello All I am doing a security audit on gnome-xml. I saw a buffer-overflow in xmllint.c in xmlHTMLPrintFileInfo( ).There is a sprintf( ) function which copies the filename to a buffer of 50,000. Since the filename can be non-local URI ,this can turn out be a vulnerability. Also in nanoftp.c in xmlNanoFTPInit( ) there is a getenv( ) call to the environment variable "ftp_proxy_password" from where the proxy password is obtained. Can this be a security issue? Also the library depends on environment variables to get HTTP and FTP proxy URLs.Can these turn out to be security concerns? Expecting your valuable feedbacks Regards Anju ------------------------------------------------------------------------ **************************Disclaimer************************************************** Information contained in this E-MAIL being proprietary to Wipro Limited is 'privileged' and 'confidential' and intended for use only by the individual or entity to which it is addressed. You are notified that any use, copying or dissemination of the information contained in the E-MAIL in any manner whatsoever is strictly prohibited. ****************************************************************************************
Attachment:
Wipro_Disclaimer.txt
Description: Text document