Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1744122-1)
Описание
The problem is caused by an incorrectly configured XML parser used by an iXML application. The parser will open by default external entities referenced within an XML input which can then lead to malicious content being parsed. This malicious content can reference internal resources, such as other XML files, which can be disclosed in the response to the request, or can be used to perform denial of service attack on the parsing system, rending application content temporarily unavailable.
Как исправить
Implementing the two notes 1712860 and 1741441 provides the infrastructure for using the iXML DTD protection functions. Implementing both notes is a prerequsite for all future security notes related to applications using the iXML Parser or XSLT. In addition to that they are providing a bug fix for security note 1594475.
Ссылки
