/ 
SOAP-Lite-0.52 UNAUTHORIZED RELEASE
Security Advisories (2)
CVE-2015-8978 (2015-07-21)

An example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to one billion copies of the first entity. The amount of computer memory used for handling an external SOAP call would likely exceed that available to the process parsing the XML.

CVE-2002-1742 (2002-04-08)

Allows remote attackers to load arbitrary Perl functions by suppling a non-existent function in a script using a SOAP::Lite module, which causes the AUTOLOAD subroutine to trigger.

Changes for version 0.52 - 2001-10-18

  • ! fixed content_type returned under mod_perl with 500 SERVER ERROR status (thanks to Geoffrey Young and Scott Hutton) ! fixed problem with multiple bindings in WSDL file generated by MS SOAP toolkit ! fixed handling of boolean type in 1999 Schema and hexBinary type in 2001 Schema ! fixed warning and problem with WOULDBLOCK state in IO::SessionData (thanks to Marty Pauley) ! fixed miscalculation in position within sparse arrays ! fixed problem with URI when methods of SOAP::Data are called in certain order (thanks to Taras Shkvarchuk) ! fixed CRLF problem in CGI module on Windows platform under IIS (thanks to Werner Ackerl) ! fixed hex and hexBinary datatypes generation ! fixed content-length calculation when payload has multibyte utf8 characters ! fixed problem with XMLRPC and nested packages with more than two levels (thanks to Leonid Gernovski) ! fixed (again) memory leak in SOAP::Parser (thanks to Craig Johnston)
  • updated Jabber interface for new format of 'use Net::Jabber ...' does not work with Net::Jabber 1.022 and later
  • updated XMLRPC::Lite to not detect value as float for 'NaN' and 'INF' strings
  • updated XMLRPC::Lite to return 200OK on errors
  • updated XMLRPC do not specify charset in content-type
  • updated Makefile.PL to allow configuration from command line (thanks to Dana Powers)
  • updated publishing API tests for UDDI server to call a new server (GLUE)
  • changed close() to shutdown() in Daemon transport (thanks to Sean Meisner)
  • added support for HTTP_proxy and HTTP_proxy_* in WSDL access (thanks to Stephen Shortland)
  • added XMLRPC support in COM interface. XMLRPC client and server can be created using COM interface
  • added DO_NOT_PROCESS_XML_IN_MIME option for MIME parts with text/xml content type
  • modified deserialization algorithm that allows to properly deserialize SOAP1.2 messages when default is set to SOAP1.1 and vice versa
  • added fault in XMLRPC::Lite for incorrect datatypes specified by user (thanks to Paul Prescod)
  • added option to not generate XML declaration
  • added encoding for ']]>' (thanks to Matt Sergeant and James Amrhein)
  • added '\r' => '
' conversion in strings
  • added complain on incorrect simple types
  • added byNameOrOrder and byName functions for SOAP::Server::Parameters (thanks to Matt Stum)
  • added handling relative locations in <import> in WSDL
  • added stringification of SOAP::Fault (thanks to Tim Jenness)
  • added documentation for SSL certificate authentication
  • added more examples (terraserver.pl, joke.pl, weblog.pl)
  • added more tests

Documentation

SOAPsh.pl
Interactive shell for SOAP calls
XMLRPCsh.pl
Interactive shell for XMLRPC calls

Modules

Apache::SOAP
mod_perl-based SOAP server with minimum configuration
Apache::XMLRPC::Lite
mod_perl-based XML-RPC server with minimum configuration
SOAP::Lite
Client and server side SOAP implementation
SOAP::Test
Test framework for SOAP::Lite
SOAP::Transport::FTP
Client side FTP support for SOAP::Lite
SOAP::Transport::HTTP
Server/Client side HTTP support for SOAP::Lite
SOAP::Transport::IO
Server side IO support for SOAP::Lite
SOAP::Transport::JABBER
Server/Client side JABBER support for SOAP::Lite
SOAP::Transport::LOCAL
Client side no-transport support for SOAP::Lite
SOAP::Transport::MAILTO
Client side SMTP/sendmail support for SOAP::Lite
SOAP::Transport::MQ
Server/Client side MQ support for SOAP::Lite
SOAP::Transport::POP3
Server side POP3 support for SOAP::Lite
SOAP::Transport::TCP
Server/Client side TCP support for SOAP::Lite
UDDI::Lite
Library for UDDI clients in Perl
XML::Parser::Lite
Lightweight regexp-based XML parser
XMLRPC::Lite
client and server implementation of XML-RPC protocol
XMLRPC::Test
Test framework for XMLRPC::Lite
XMLRPC::Transport::HTTP
Server/Client side HTTP support for XMLRPC::Lite
XMLRPC::Transport::POP3
Server side POP3 support for XMLRPC::Lite
XMLRPC::Transport::TCP
Server/Client side TCP support for XMLRPC::Lite

Provides

IO::SessionData
in lib/IO/SessionData.pm
IO::SessionSet
in lib/IO/SessionSet.pm
LWP::Protocol
in lib/SOAP/Transport/HTTP.pm UNAUTHORIZED
My::PingPong
in lib/SOAP/Test.pm
My::PingPong
in lib/XMLRPC/Test.pm
SOAP
in lib/SOAP/Lite.pm
SOAP::Client
in lib/SOAP/Lite.pm
SOAP::Cloneable
in lib/SOAP/Lite.pm
SOAP::Constants
in lib/SOAP/Lite.pm
SOAP::Custom::XML::Data
in lib/SOAP/Lite.pm
SOAP::Custom::XML::Deserializer
in lib/SOAP/Lite.pm
SOAP::Data
in lib/SOAP/Lite.pm
SOAP::Deserializer
in lib/SOAP/Lite.pm
SOAP::Fault
in lib/SOAP/Lite.pm
SOAP::Header
in lib/SOAP/Lite.pm
SOAP::Lite::COM
in lib/SOAP/Lite.pm
SOAP::MIMEParser
in lib/SOAP/Lite.pm
SOAP::Parser
in lib/SOAP/Lite.pm
SOAP::SOM
in lib/SOAP/Lite.pm
SOAP::Schema
in lib/SOAP/Lite.pm
SOAP::Schema::Deserializer
in lib/SOAP/Lite.pm
SOAP::Schema::WSDL
in lib/SOAP/Lite.pm
SOAP::Serializer
in lib/SOAP/Lite.pm
SOAP::Server
in lib/SOAP/Lite.pm
SOAP::Server::Object
in lib/SOAP/Lite.pm
SOAP::Server::Parameters
in lib/SOAP/Lite.pm
SOAP::Test::Server
in lib/SOAP/Test.pm
SOAP::Trace
in lib/SOAP/Lite.pm
SOAP::Transport
in lib/SOAP/Lite.pm
SOAP::Transport::FTP::Client
in lib/SOAP/Transport/FTP.pm
SOAP::Transport::HTTP::Apache
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::HTTP::CGI
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::HTTP::Client
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::HTTP::Daemon
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::HTTP::FCGI
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::HTTP::Server
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::IO::Server
in lib/SOAP/Transport/IO.pm
SOAP::Transport::JABBER::Client
in lib/SOAP/Transport/JABBER.pm
SOAP::Transport::JABBER::Query
in lib/SOAP/Transport/JABBER.pm
SOAP::Transport::JABBER::Server
in lib/SOAP/Transport/JABBER.pm
SOAP::Transport::LOCAL::Client
in lib/SOAP/Transport/LOCAL.pm
SOAP::Transport::MAILTO::Client
in lib/SOAP/Transport/MAILTO.pm
SOAP::Transport::MQ::Client
in lib/SOAP/Transport/MQ.pm
SOAP::Transport::MQ::Server
in lib/SOAP/Transport/MQ.pm
SOAP::Transport::POP3::Server
in lib/SOAP/Transport/POP3.pm
SOAP::Transport::TCP::Client
in lib/SOAP/Transport/TCP.pm
SOAP::Transport::TCP::Server
in lib/SOAP/Transport/TCP.pm
SOAP::Utils
in lib/SOAP/Lite.pm
SOAP::XMLSchema1999::Deserializer
in lib/SOAP/Lite.pm
SOAP::XMLSchema1999::Serializer
in lib/SOAP/Lite.pm
SOAP::XMLSchema2001::Deserializer
in lib/SOAP/Lite.pm
SOAP::XMLSchema2001::Serializer
in lib/SOAP/Lite.pm
SOAP::XMLSchema::Serializer
in lib/SOAP/Lite.pm
SOAP::XMLSchemaApacheSOAP::Deserializer
in lib/SOAP/Lite.pm
SOAP::XMLSchemaSOAP1_1::Deserializer
in lib/SOAP/Lite.pm
SOAP::XMLSchemaSOAP1_2::Deserializer
in lib/SOAP/Lite.pm
UDDI::Data
in lib/UDDI/Lite.pm
UDDI::Deserializer
in lib/UDDI/Lite.pm
UDDI::SOM
in lib/UDDI/Lite.pm
UDDI::Serializer
in lib/UDDI/Lite.pm
URI::jabber
in lib/SOAP/Transport/JABBER.pm
URI::mq
in lib/SOAP/Transport/MQ.pm
URI::tcp
in lib/SOAP/Transport/TCP.pm
XMLRPC
in lib/XMLRPC/Lite.pm
XMLRPC::Constants
in lib/XMLRPC/Lite.pm
XMLRPC::Data
in lib/XMLRPC/Lite.pm
XMLRPC::Deserializer
in lib/XMLRPC/Lite.pm
XMLRPC::SOM
in lib/XMLRPC/Lite.pm
XMLRPC::Serializer
in lib/XMLRPC/Lite.pm
XMLRPC::Server
in lib/XMLRPC/Lite.pm
XMLRPC::Server::Parameters
in lib/XMLRPC/Lite.pm
XMLRPC::Test::Server
in lib/XMLRPC/Test.pm
XMLRPC::Transport::HTTP::Apache
in lib/XMLRPC/Transport/HTTP.pm
XMLRPC::Transport::HTTP::CGI
in lib/XMLRPC/Transport/HTTP.pm
XMLRPC::Transport::HTTP::Daemon
in lib/XMLRPC/Transport/HTTP.pm
XMLRPC::Transport::POP3::Server
in lib/XMLRPC/Transport/POP3.pm
XMLRPC::Transport::TCP::Server
in lib/XMLRPC/Transport/TCP.pm

Examples

Other files