Re:Security releases issued
by _carljm on Tuesday February 19, 2013 @07:06PM
(#5248052)
The vulnerability we fixed is not just entity expansion, it's also accessing external entities. Although this is a DoS vector, I think it's true that it could be used to gain information about the presence or absence of files on the local filesystem, or even potentially information about their contents (given access to the results of XML parsing).
[ Parent
| on HN ]
Re:Security releases issued
by lawnchair_larry on Tuesday February 19, 2013 @07:54PM
(#5248258)
You can also use it to reference arbitrary remote URIs. Suddenly your XML parser is making outbound connections to anywhere the attacker specifies, looking for more XML to process.
On some Windows systems, you can use a UNC path (\\share) and force the parser to try and connect to a share that the attacker controls, which will cause windows to hand over the user's hash during the handshake.