lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 11 Aug 2013 20:05:12 +0300
From: "MustLive" <>
To: <>, <>
Subject: XXE Injection in Sybase EAServer


I'll give you additional information concerning advisory SEC Consult
SA-20130719-0 :: Multiple vulnerabilities in Sybase EAServer
( It's about XXE Injection in Sybase

Among vulnerabilities in EAServer there is XXE Injection and it was only
mentioned about local file inclusion and directory listing attack vector.
But this XXE Injection vulnerability also allows to conduct attacks on other
sites. So I'll supplement SEC Consult's advisory and will bring your
attention to another attack vector.

I wrote about such attacks in my 2012's article "Using XML External Entities
(XXE) for attacks on other sites"
and 2013's "Using XXE vulnerabilities for attacks on other sites"
As I described in my articles, XXE vulnerabilities can be used for
conducting CSRF and DoS attacks on other sites (and at using multiple web
sites it's possible to conduct DDoS attacks). And last month I released a
tool for conducting such attacks - in DAVOSET v.1.1.2 I added support of XML
requests for XXE vulnerabilities.

XXE (WASC-43):

For the attack it's needed to send the next XML data in POST request.

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "http://site/page">]>

So all servers with affected versions of Sybase EAServer can be used for
attacks on other sites via XXE.

Best wishes & regards,
Administrator of Websecurity web site 

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists