Bug 840753 (CVE-2013-1881) - VUL-0: CVE-2013-1881: librsvg: local resource access vulnerability due to XML External Entity enablement
Summary: VUL-0: CVE-2013-1881: librsvg: local resource access vulnerability due to XML...
Status: RESOLVED FIXED
Alias: CVE-2013-1881
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: CVSSv2:RedHat:CVE-2013-1881:4.3:(AV:N...
Keywords:
Depends on:
Blocks:
 
Reported: 2013-09-17 08:19 UTC by Alexander Bergmann
Modified: 2017-01-11 02:01 UTC (History)
8 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
Patch for SLE11-SP1 (1.40 KB, patch)
2013-11-11 21:04 UTC, Federico Mena Quintero
Details | Diff
gtk+ patch for openSUSE 12.3 (2.71 KB, patch)
2013-12-03 00:00 UTC, Federico Mena Quintero
Details | Diff
gtk+ patch for openSUSE 12.2 (3.95 KB, patch)
2013-12-03 00:30 UTC, Federico Mena Quintero
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2013-09-17 08:19:33 UTC
Public via Red Hat.

https://bugzilla.redhat.com/show_bug.cgi?id=924414

It was reported [1] that librsvg2, via gnome-vfs, is vulnerable to a local resource access vulnerability via XML External Entity expansion.  If a user were to view a folder containing a malicious SVG file, or open the file, GVFS would send the local resource's contents to the attacker's server.  A patch [2] is attached to the bug report which restricts what is permitted to be loaded.

[1] https://bugzilla.gnome.org/show_bug.cgi?id=691708
[2] https://bug691708.bugzilla-attachments.gnome.org/attachment.cgi?id=238516&t=9sD7BFBKk1

CVE-2013-1881 was assigned for this issue.

Fixes:

https://git.gnome.org/browse/librsvg/commit/?id=d83e426fff3f6d0fa6042d0930fb70357db24125
https://git.gnome.org/browse/librsvg/commit/?id=f01aded72c38f0e18bc7ff67dee800e380251c8e

Regression fix in gtk+:

https://git.gnome.org/browse/gtk+/commit/?id=7b4f82ccc6c180b809cd3b7b6582394ce741a14e
Comment 1 Swamp Workflow Management 2013-09-17 22:00:10 UTC
bugbot adjusting priority
Comment 2 Scott Reeves 2013-10-08 00:39:54 UTC
I have fixes ready for 12.2 and 12.3. Note that the regression fix in gtk+ listed above was not sufficient and required an update committed last week (3d602f5). We might want to wait a little longer for upstream testing to continue before releasing...

Back porting these fixes for our SLE code base is proving quite involved. Still working on this...
Comment 3 Scott Reeves 2013-10-18 19:11:40 UTC
I have not been able to duplicate this vulnerability so it's hard to test if the fixes work. In my constructed svg file I can not get the parsing libraries to send the contents of a local network resource to my "evil" server. I get parameter references forbidden in internal subset errors which it seems like is the supposed hole this bug tries to exploit.

I tried with the setup detailed in the upstream bug and also found a (I presume affiliated with the reporters of this bug) blackhat 2013 presentation - http://www.slideshare.net/qqlan/bh-ready-v4.

Federico - can you help look into this. I will send you my setup so far (and my fixes for 12.2 and 12.3 are in my home:sreeves1:branch)
Comment 4 Federico Mena Quintero 2013-10-21 20:45:34 UTC
I'm on this.
Comment 5 Federico Mena Quintero 2013-11-07 00:42:15 UTC
Scott is right; backporting all the changes done to librsvg to sanitize the "load data" path is quite complicated.  First they abstracted out I/O, then a lot of changes resulted because of that.  I don't feel comfortable backporting all of this and not having all the intermediate fixes to the rest of the code.

It sounds like for SLE11-SP2 it's only reasonable to have the changes to use XML_PARSE_NONET.  I'll submit the patches tomorrow morning.
Comment 6 Federico Mena Quintero 2013-11-11 21:02:27 UTC
Submitted on the IBS for SLE11-SP2 with request id 29283.
Comment 7 Federico Mena Quintero 2013-11-11 21:04:37 UTC
Created attachment 566950 [details]
Patch for SLE11-SP1
Comment 8 Federico Mena Quintero 2013-11-11 21:05:25 UTC
I meant SLE11-SP1; that's where librsvg lives in SLE11.
Comment 9 Federico Mena Quintero 2013-11-12 01:52:25 UTC
Submitted to openSUSE_12.2_Update with id 206571.

Submitted to openSUSE_12.3_Update with id 206572.
Comment 10 Federico Mena Quintero 2013-11-12 01:54:07 UTC
Reassigning to security-team for release.
Comment 11 Bernhard Wiedemann 2013-11-12 02:00:11 UTC
This is an autogenerated message for OBS integration:
This bug (840753) was mentioned in
https://build.opensuse.org/request/show/206571 12.2 / librsvg
https://build.opensuse.org/request/show/206572 12.3 / librsvg
Comment 13 Marcus Meissner 2013-11-20 16:53:49 UTC
13.1 and factory?
Comment 14 Swamp Workflow Management 2013-11-29 22:04:25 UTC
openSUSE-SU-2013:1786-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 840753
CVE References: CVE-2013-1881
Sources used:
openSUSE 12.3 (src):    librsvg-2.36.4-2.4.1
openSUSE 12.2 (src):    librsvg-2.36.1-2.4.1
Comment 15 Markus Kolb 2013-11-30 12:21:14 UTC
These patches breaks my icons in the Gnome upper right menu bar for changing volume, handling bluetooth and wlan, logout/switchoff.

openSUSE 12.3 x86-64
Comment 16 David Walker 2013-12-01 08:12:46 UTC
I also lost icons in the upper right menu bar, as well as other Gnome icons, such as the up/down arrows in Gedit's find dialog.  I retreated to the version of the package in the OSS repository.  This happened on two openSUSE 12.3 systems, one x86-64 and one i586.
Comment 17 John McKnight 2013-12-01 15:47:04 UTC
The same happened to me as well. Icons in the upper right and "show applications" icon all went missing. Not only did this happen with the GNOME desktop but they were missing from the top right in GDM as well.

I'm on 12.3 x86_64.
Comment 18 Tomas Polak 2013-12-01 18:45:14 UTC
Same on my computer with OpenSUSE 12.3 64bit. After applying patch to librsvg-2-2 2.36.4-2.4.1 I am missing some icons in GNOME theme (some nautilus icons, sound icon, network manager icon,...). Buttons work but there's no graphics on them. After downgrading to librsvg-2-2 2.36.4-2.1.1 and rebooting all icons appear.

Was: 2.36.4-2.4.1 (x86_64)
Downgraded to: 2.36.4-2.1.1 (x86_64)
Comment 19 Federico Mena Quintero 2013-12-02 18:29:20 UTC
This also needs a patch in gtk+; I'll take care of it.  This is why the icons are not showing up.
Comment 20 Federico Mena Quintero 2013-12-03 00:00:55 UTC
Created attachment 569888 [details]
gtk+ patch for openSUSE 12.3
Comment 21 Federico Mena Quintero 2013-12-03 00:30:59 UTC
Created attachment 569891 [details]
gtk+ patch for openSUSE 12.2
Comment 22 Marcus Meissner 2013-12-03 16:21:47 UTC
can you submit fixed gtk packages for opensuse 12.2 and 12.3?
Comment 23 Bernhard Wiedemann 2013-12-03 21:00:15 UTC
This is an autogenerated message for OBS integration:
This bug (840753) was mentioned in
https://build.opensuse.org/request/show/209345 12.2 / gtk3
https://build.opensuse.org/request/show/209346 12.3 / gtk3
Comment 24 Federico Mena Quintero 2013-12-03 21:17:14 UTC
Submitted gtk3 for openSUSE 12.2 with id 209345.

Submitted gtk3 for openSUSE 12.3 with id 209346.

I'll reassign this to security-team for the release.
Comment 25 Federico Mena Quintero 2013-12-04 02:06:08 UTC
Aaargh, we also need commit 3d602f5 from gtk+.  I'll redo the patch.
Comment 26 Marcus Meissner 2013-12-06 09:50:08 UTC
any news? 

We did not retrtact the update in hope of a quick solution, but this did not come :(

Now it would be better to push an update with revert unless we get fixes today :/
Comment 27 Mandie Smith 2013-12-06 22:08:21 UTC
I'm adding a me too for the missing icon issue.  Downgrading resolved it.

Was: 2.36.4-2.4.1 (x86_64)
Downgraded to: 2.36.4-2.1.1 (x86_64)
Comment 28 Marcus Meissner 2013-12-09 17:05:10 UTC
Federico?
Comment 29 Federico Mena Quintero 2013-12-11 23:46:39 UTC
It turns out that gtk+ 3.10.4, which we have in openSUSE 13.1, already has that commit.  Previous versions don't need it, as far as I can tell.  I'm terribly sorry; I forgot to reassign this to security-team.
Comment 30 David Shuman 2013-12-12 00:09:45 UTC
Me too -- as far as the symptoms -- I have not been able to apply the fix.
Comment 31 Markus Kolb 2013-12-12 10:31:16 UTC
Hi, I can confirm that the Federico's gtk3 patch fixes the icon problem.
Everything is running smoothly here now ;-)
I think you can release the fixes altogether.
Comment 32 Marcus Meissner 2014-01-14 08:39:28 UTC
was released on dec 19th
Comment 33 SMASH SMASH 2014-02-17 08:45:41 UTC
Affected packages:

SLE-11-SP3: librsvg
SLE-11-SP2: librsvg
SLE-9-SP3-TERADATA: librsvg
SLE-9-SP4: librsvg
Comment 35 Swamp Workflow Management 2015-10-20 11:10:26 UTC
SUSE-SU-2015:1785-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 840753
CVE References: CVE-2013-1881
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    librsvg-2.26.0-2.5.1
SUSE Linux Enterprise Software Development Kit 11-SP3 (src):    librsvg-2.26.0-2.5.1
SUSE Linux Enterprise Server for VMWare 11-SP3 (src):    librsvg-2.26.0-2.5.1
SUSE Linux Enterprise Server 11-SP4 (src):    librsvg-2.26.0-2.5.1
SUSE Linux Enterprise Server 11-SP3 (src):    librsvg-2.26.0-2.5.1
SUSE Linux Enterprise Desktop 11-SP4 (src):    librsvg-2.26.0-2.5.1
SUSE Linux Enterprise Desktop 11-SP3 (src):    librsvg-2.26.0-2.5.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    librsvg-2.26.0-2.5.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    librsvg-2.26.0-2.5.1