NextApp Echo XML Parsing Local File Disclosure Vulnerability

Bugtraq ID:	34060
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 24 2009 12:00AM
Updated:	Mar 12 2009 03:46PM
Credit:	An anonymous researcher and SEC Consult Vulnerability Lab
Vulnerable:	NextApp Echo 2.1 NextApp Echo 3.0.b5
Not Vulnerable:	NextApp Echo 2.1.1 NextApp Echo 3.0.b6

NextApp Echo XML Parsing Local File Disclosure Vulnerability

NextApp Echo is prone to a local file-disclosure vulnerability caused by a design error.

An attacker can exploit this vulnerability to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

The issue affects versions prior to Echo 2.1.1 and 3.0.b6.

NextApp Echo XML Parsing Local File Disclosure Vulnerability

Attackers may exploit this issue through a browser.

The following example XML input is available:

<?xml version="1.0"?><!DOCTYPE sec [<!ELEMENT sec ANY><!ENTITY mytestentity SYSTEM "file:///c:\boot.ini">]>

NextApp Echo XML Parsing Local File Disclosure Vulnerability

Solution:
The vendor has released fixes. Please see the references for more information.

NextApp Echo XML Parsing Local File Disclosure Vulnerability

References:

• Echo Homepage (NextApp)
  
• SEC Consult SA-20090305-0 :: NextApp Echo XML Injection Vulnerability (Bernhard Mueller )
  
• SEC Consult SA-20090305-0 :: NextApp Echo XML Injection Vulnerability (Bernhard Mueller )
  
• Security Update: Echo 2.1.1, 3.0.b6 Available (NextApp)