You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@flex.apache.org by Christofer Dutz <cd...@apache.org> on 2015/08/19 13:48:04 UTC
CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion
Vulnerability
CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion
Vulnerability
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected: Apache Flex BlazeDS 4.7.0
Description: When receiving XML encoded AMF messages containing DTD
entities, the
default XML parser configurations allows expanding of entities to local
resources.
A request that included a specially crafted request parameter could be
used to
access content that would otherwise be protected.
Mitigation: All users of Apache Flex BlazeDS prior to 4.7.1
Example: For an AMF message that contains the following xml payload:
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>
the entity &xxe; would be expanded to the content of the file /etc/passwd.
However this expanded information is not automatically transferred back to
the client, but could be made available by the application.
Credit: This issue was discovered by Matthias Kaiser of Code White
References:
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
Christofer Dutz
Re: CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion
Vulnerability
Posted by Alex Harui <ah...@adobe.com>.
For questions about Adobe releases, email PSIRT@adobe.com.
-Alex
On 8/19/15, 5:13 AM, "Tom Chiverton" <tc...@extravision.com> wrote:
>On 19/08/15 13:07, Andrew Kerr wrote:
>> Does anyone know if this affects the older Adobe BlazeDS 4.6.0?
>
>You'd need to check with Adobe.
>
>They published an advisor today on the topic :
>http://blogs.adobe.com/psirt/?p=1259
>but it only mentions LiveCycle DS.
>
>Tom
Re: CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion Vulnerability
Posted by Andrew Kerr <ak...@fluid.com>.
Thanks, that's what I thought. We will make the move to upgrade to 4.7.1
from 4.6.
On Wed, Aug 19, 2015 at 8:27 AM, Christofer Dutz <ch...@c-ware.de>
wrote:
> Hi Andrew,
>
> Well as 4.7.0 was the parity-release to 4.6.0 and we didn't really change
> any functionality since the donation prior to 4.7.0, I would bet on it. To
> me it looked as if this issue must have been sitting there since the dawn
> of time. But we explicitly didn't want to mention Adobe BlazeDS in our
> announcement.
>
> Chris
>
> ________________________________________
> Von: Tom Chiverton <tc...@extravision.com>
> Gesendet: Mittwoch, 19. August 2015 14:13
> An: users@flex.apache.org
> Betreff: Re: CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity
> Expansion Vulnerability
>
> On 19/08/15 13:07, Andrew Kerr wrote:
> > Does anyone know if this affects the older Adobe BlazeDS 4.6.0?
>
> You'd need to check with Adobe.
>
> They published an advisor today on the topic :
> http://blogs.adobe.com/psirt/?p=1259
> but it only mentions LiveCycle DS.
>
> Tom
>
--
Andrew Kerr
AW: CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion
Vulnerability
Posted by Christofer Dutz <ch...@c-ware.de>.
Hi Andrew,
Well as 4.7.0 was the parity-release to 4.6.0 and we didn't really change any functionality since the donation prior to 4.7.0, I would bet on it. To me it looked as if this issue must have been sitting there since the dawn of time. But we explicitly didn't want to mention Adobe BlazeDS in our announcement.
Chris
________________________________________
Von: Tom Chiverton <tc...@extravision.com>
Gesendet: Mittwoch, 19. August 2015 14:13
An: users@flex.apache.org
Betreff: Re: CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion Vulnerability
On 19/08/15 13:07, Andrew Kerr wrote:
> Does anyone know if this affects the older Adobe BlazeDS 4.6.0?
You'd need to check with Adobe.
They published an advisor today on the topic :
http://blogs.adobe.com/psirt/?p=1259
but it only mentions LiveCycle DS.
Tom
Re: CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion
Vulnerability
Posted by Tom Chiverton <tc...@extravision.com>.
On 19/08/15 13:07, Andrew Kerr wrote:
> Does anyone know if this affects the older Adobe BlazeDS 4.6.0?
You'd need to check with Adobe.
They published an advisor today on the topic :
http://blogs.adobe.com/psirt/?p=1259
but it only mentions LiveCycle DS.
Tom
Re: CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion Vulnerability
Posted by Andrew Kerr <ak...@fluid.com>.
Does anyone know if this affects the older Adobe BlazeDS 4.6.0?
Thanks,
Andrew
On Wed, Aug 19, 2015 at 7:48 AM, Christofer Dutz <cd...@apache.org> wrote:
> CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion
> Vulnerability
>
> Severity: Important
>
> Vendor: The Apache Software Foundation
>
> Versions Affected: Apache Flex BlazeDS 4.7.0
>
> Description: When receiving XML encoded AMF messages containing DTD
> entities, the
> default XML parser configurations allows expanding of entities to local
> resources.
> A request that included a specially crafted request parameter could be
> used to
> access content that would otherwise be protected.
>
>
> Mitigation: All users of Apache Flex BlazeDS prior to 4.7.1
>
> Example: For an AMF message that contains the following xml payload:
> <?xml version="1.0" encoding="ISO-8859-1"?>
> <!DOCTYPE foo [
> <!ELEMENT foo ANY >
> <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>
> the entity &xxe; would be expanded to the content of the file /etc/passwd.
> However this expanded information is not automatically transferred back to
> the client, but could be made available by the application.
>
> Credit: This issue was discovered by Matthias Kaiser of Code White
>
> References:
> https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
>
> Christofer Dutz
>
--
Andrew Kerr