Integer Overflow in Expat XML Parser

Executive Summary

This vulnerability is an integer overflow in the xmlwf tool within the libexpat library, specifically in the endDoctypeDecl() function. The function counts NOTATION declarations using a plain integer and then allocates memory based on this count without checking for overflow. On 32-bit systems, this can cause the multiplication to wrap around, leading to allocating less memory than needed. When the program writes data into this undersized buffer, it can cause memory corruption or crashes.

The issue is fixed by changing the count variable to a size_t type and adding an overflow check to ensure the allocation size does not exceed the maximum allowed size, preventing the integer overflow and ensuring safe memory allocation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to memory corruption or crashes when processing NOTATION declarations in XML documents using the xmlwf tool from libexpat. Such memory corruption could potentially be exploited to cause denial of service or, in some cases, arbitrary code execution depending on the context in which the library is used.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is related to an integer overflow in the xmlwf tool within the libexpat library, specifically in the endDoctypeDecl function when processing NOTATION declarations in DTDs.

Detection would involve identifying usage of vulnerable versions of libexpat (before 2.8.2) on your system or network.

You can check the installed version of libexpat with commands like:

• dpkg -l | grep libexpat # On Debian/Ubuntu systems
• rpm -qa | grep expat # On RedHat/CentOS systems

Additionally, you can check if the xmlwf tool is present and its version by running:

• xmlwf --version

To detect attempts to exploit this vulnerability, monitor logs or network traffic for malformed XML documents containing NOTATION declarations in DTDs that might trigger the integer overflow.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to update libexpat to version 2.8.2 or later, where the integer overflow issue in xmlwf has been fixed.

If immediate update is not possible, consider restricting or disabling processing of XML documents with NOTATION declarations in DTDs, especially from untrusted sources.

Additionally, monitor your systems for crashes or memory corruption symptoms related to xmlwf usage.

Useful 0 Not Useful 0