BugTraq
XXE (Xml eXternal Entity) attack Oct 29 2002 11:23PM
Gregory Steuck (greg-xxe nest cx) (1 replies)
Re: XXE (Xml eXternal Entity) attack Oct 30 2002 09:15AM
Miles Sabin (miles milessabin com)
Gregory Steuck wrote,
> Gregory Steuck security advisory #1, 2002

Excellent stuff ... I've posted a link to the bugtraq archive to
xml-dev.

> Acknowledgments:
> Even though the issue was discovered and researched independently I
> cannot claim to be the first one to realize the risks associated
> with XML external entities. E.g. RFC 2518 discusses the issue in
> section 17.7 Implications of XML External Entities.

FWIW, this has been an occasional topic of discussion on xml-dev for the
last couple of years. See here,

http://www.megginson.com/ugly/slides/
http://lists.xml.org/archives/xml-dev/200101/msg00057.html
http://lists.xml.org/archives/xml-dev/200206/msg00240.html
http://lists.xml.org/archives/xml-dev/200206/msg00247.html
http://lists.xml.org/archives/xml-dev/200210/msg01461.html

The xml-dev reaction has by and large been "of course, don't do that",
but xml-dev is a relatively rarified place, so it's nice to seeing this
issue getting wider security related circulation. It's also nice to see
someone not just discussing theoretical attacks, but actually testing
deployed software.

Cheers,

Miles

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus