CERT-FI Advisory on XML Libraries

Several vulnerabilities regarding the parsing of XML data have been found in XML library implementations. The vulnerabilities are related to the parsing of XML elements with unexpected byte values and recursive parentheses, which cause the program to access memory out of bounds, or to loop indefinitely. The effects of the vulnerabilities include denial of service and potentially code execution.

Some of the most popular open source XML libraries are found to be vulnerable. Please refer to http://www.cert.fi/en/reports/2009/vulnerability2009085.html for details of the vulnerabilities and a list of libraries affected.

XML Security in NetScaler

The NetScaler Application Firewall module includes an XML-aware engine that powers specific XML attack protections. In addition to protecting XML-based applications from attack, NetScaler ensures that incoming XML traffic conforms to the appropriate standards (e.g., XML syntax, schema, WSDL validation).

NetScaler XML Security features that protect against the above vulnerabilities include Format Checks and Denial of Service Prevention. Format Checks prevents malformed or not well-formed messages from reaching the server. Denial of Service Prevention thwarts attacks (like large elements, deeply nested messages, etc.) that attempt to exhaust server resources or exploit weakness in the xml parsers and applications on the server.

For a more comprehensive list of XML security features included in Netscaler, click here.

NetScaler's Application Firewall offers great protection for Web Applications via a positive security model that lets the user decide what is allowed to reach their web server. Web site vulnerability and compliance requirements can be met by deploying this integrated firewall.

But the concept of the web is changing. Expanding beyond the traditional web pages, many sites now include programmable interfaces accessible via XML based APIs. While web sites are mainly for consumers, the programmable APIs are used by business partners and customers to automate and integrate systems. The APIs are also getting used by emerging Web 2.0 enabled Rich Internet Applications (such as Adobe Flex and Microsoft Silverlight) that get deployed inside a consumer's browser. Once deployed, these RIAs will make active and passive calls to the exposed APIs of a web site. Often exchanging information in the background using an XML based protocol like REST or Web Services.

As the Web and programmatic APIs continue to become more of an integrated offering, it is important to provide security for the APIs as well as for the Web site. NetScaler 9.0 introduces a major new module inside the Application Firewall centered on XML Security. With these new capabilities, users will be able to simultaneously secure HTML based web sites as well as XML based REST and Web Services APIs.      

_{Useful Links}

• XML Security Features in Netscaler 9.0

_XML

_{Extensible Markup Language (XML) is a W3C standard for creating custom markup language to representing structured data in text.}

_{Characteristics of XML}

• Simple and Plain Text
  • Easy to read and understand both for humans and computers
  • Supports "all" platforms and programming languages
  • Supports multi-lingual documents
• Self-description
  • Meta data in the form of tags and attributes
  • Simplifies tools/programs development
• Open
  • Widely adopted World Wide Web Consortium (W3C) standard since 1998
• Extensibility
  • No fixed set of tags. New tags can be created as they are needed.
  • Can express complex messages.

_{Sample XML}

<?xml version="1.0" encoding="UTF-8"?>
<Bio>
     <Name>
        <First> John </First>
        <Last> Smith </Last>
     </Name>
     <Company current="Yes">
         Acme Open Source Software Center
     </Company>
</Bio>

_{Useful Links}

• XML Security Features in Netscaler 9.0
• XML Specification: http://www.w3.org/TR/REC-xml/
• Wikipedia: http://en.wikipedia.org/wiki/XML

One of the long awaited new features in NetScaler 9.0 is XML security.  In 2007, Citrix acquired QuickTree, a small privately-held software technology provider on the forefront of addressing the key security and performance challenges of XML, web services and Web 2.0.  With Netscaler 9.0 the XML security capabilities acquired from QuickTree are fully integrated into the Netscaler web application delivery appliance.

Some the XML Security Features available in the new NetScaler release: