/ 
SOAP-Lite-0.55 UNAUTHORIZED RELEASE
Security Advisories (1)
CVE-2015-8978 (2015-07-21)

An example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to one billion copies of the first entity. The amount of computer memory used for handling an external SOAP call would likely exceed that available to the process parsing the XML.

Changes for version 0.55 - 2002-04-15

  • ! fixed security vulnerability with fully qualified method names (thanks to Randal Schwartz, Ilya Martynov and many others) ! fixed problem with TCP transport and SSL (thanks to Chris Hurd) ! fixed TCP transport to specify correct length with utf8 strings (thanks to Robin Fuller) ! fixed incorrect encoding when parameters list includes undefined values (thanks to Chris Radcliff) ! updated 'xmlsoap' prefix (thanks to Pierre Denis) ! updated MIME parser to accept messages that start with 'From' (thanks to Chris Davies)
  • added check for TCP transport on Mac (thanks to Robin Fuller)
  • added check for shutdown() method on AIX (thanks to Jos Clijmans)
  • added check for blocking() method in TCP transport (thanks to Jos Clijmans)
  • optimized parsing strings with entity encoding (thanks to Mathieu Longtin)
  • added check for entity size for CGI transport ($SOAP::Constant::MAX_CONTENT_SIZE) (thanks to J. Klunder)
  • added example (google.pl)
  • updated tests and examples with new endpoints

Documentation

SOAPsh.pl
Interactive shell for SOAP calls
XMLRPCsh.pl
Interactive shell for XMLRPC calls

Modules

Apache::SOAP
mod_perl-based SOAP server with minimum configuration
Apache::XMLRPC::Lite
mod_perl-based XML-RPC server with minimum configuration
SOAP::Lite
Client and server side SOAP implementation
SOAP::Test
Test framework for SOAP::Lite
SOAP::Transport::FTP
Client side FTP support for SOAP::Lite
SOAP::Transport::HTTP
Server/Client side HTTP support for SOAP::Lite
SOAP::Transport::IO
Server side IO support for SOAP::Lite
SOAP::Transport::JABBER
Server/Client side JABBER support for SOAP::Lite
SOAP::Transport::LOCAL
Client side no-transport support for SOAP::Lite
SOAP::Transport::MAILTO
Client side SMTP/sendmail support for SOAP::Lite
SOAP::Transport::MQ
Server/Client side MQ support for SOAP::Lite
SOAP::Transport::POP3
Server side POP3 support for SOAP::Lite
SOAP::Transport::TCP
Server/Client side TCP support for SOAP::Lite
UDDI::Lite
Library for UDDI clients in Perl
XML::Parser::Lite
Lightweight regexp-based XML parser
XMLRPC::Lite
client and server implementation of XML-RPC protocol
XMLRPC::Test
Test framework for XMLRPC::Lite
XMLRPC::Transport::HTTP
Server/Client side HTTP support for XMLRPC::Lite
XMLRPC::Transport::POP3
Server side POP3 support for XMLRPC::Lite
XMLRPC::Transport::TCP
Server/Client side TCP support for XMLRPC::Lite

Provides

IO::SessionData
in lib/IO/SessionData.pm
IO::SessionSet
in lib/IO/SessionSet.pm
LWP::Protocol
in lib/SOAP/Transport/HTTP.pm UNAUTHORIZED
My::PingPong
in lib/SOAP/Test.pm
My::PingPong
in lib/XMLRPC/Test.pm
SOAP
in lib/SOAP/Lite.pm
SOAP::Client
in lib/SOAP/Lite.pm
SOAP::Cloneable
in lib/SOAP/Lite.pm
SOAP::Constants
in lib/SOAP/Lite.pm
SOAP::Custom::XML::Data
in lib/SOAP/Lite.pm
SOAP::Custom::XML::Deserializer
in lib/SOAP/Lite.pm
SOAP::Data
in lib/SOAP/Lite.pm
SOAP::Deserializer
in lib/SOAP/Lite.pm
SOAP::Fault
in lib/SOAP/Lite.pm
SOAP::Header
in lib/SOAP/Lite.pm
SOAP::Lite::COM
in lib/SOAP/Lite.pm
SOAP::MIMEParser
in lib/SOAP/Lite.pm
SOAP::Parser
in lib/SOAP/Lite.pm
SOAP::SOM
in lib/SOAP/Lite.pm
SOAP::Schema
in lib/SOAP/Lite.pm
SOAP::Schema::Deserializer
in lib/SOAP/Lite.pm
SOAP::Schema::WSDL
in lib/SOAP/Lite.pm
SOAP::Serializer
in lib/SOAP/Lite.pm
SOAP::Server
in lib/SOAP/Lite.pm
SOAP::Server::Object
in lib/SOAP/Lite.pm
SOAP::Server::Parameters
in lib/SOAP/Lite.pm
SOAP::Test::Server
in lib/SOAP/Test.pm
SOAP::Trace
in lib/SOAP/Lite.pm
SOAP::Transport
in lib/SOAP/Lite.pm
SOAP::Transport::FTP::Client
in lib/SOAP/Transport/FTP.pm
SOAP::Transport::HTTP::Apache
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::HTTP::CGI
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::HTTP::Client
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::HTTP::Daemon
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::HTTP::FCGI
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::HTTP::Server
in lib/SOAP/Transport/HTTP.pm
SOAP::Transport::IO::Server
in lib/SOAP/Transport/IO.pm
SOAP::Transport::JABBER::Client
in lib/SOAP/Transport/JABBER.pm
SOAP::Transport::JABBER::Query
in lib/SOAP/Transport/JABBER.pm
SOAP::Transport::JABBER::Server
in lib/SOAP/Transport/JABBER.pm
SOAP::Transport::LOCAL::Client
in lib/SOAP/Transport/LOCAL.pm
SOAP::Transport::MAILTO::Client
in lib/SOAP/Transport/MAILTO.pm
SOAP::Transport::MQ::Client
in lib/SOAP/Transport/MQ.pm
SOAP::Transport::MQ::Server
in lib/SOAP/Transport/MQ.pm
SOAP::Transport::POP3::Server
in lib/SOAP/Transport/POP3.pm
SOAP::Transport::TCP::Client
in lib/SOAP/Transport/TCP.pm
SOAP::Transport::TCP::Server
in lib/SOAP/Transport/TCP.pm
SOAP::Utils
in lib/SOAP/Lite.pm
SOAP::XMLSchema1999::Deserializer
in lib/SOAP/Lite.pm
SOAP::XMLSchema1999::Serializer
in lib/SOAP/Lite.pm
SOAP::XMLSchema2001::Deserializer
in lib/SOAP/Lite.pm
SOAP::XMLSchema2001::Serializer
in lib/SOAP/Lite.pm
SOAP::XMLSchema::Serializer
in lib/SOAP/Lite.pm
SOAP::XMLSchemaApacheSOAP::Deserializer
in lib/SOAP/Lite.pm
SOAP::XMLSchemaSOAP1_1::Deserializer
in lib/SOAP/Lite.pm
SOAP::XMLSchemaSOAP1_2::Deserializer
in lib/SOAP/Lite.pm
UDDI::Data
in lib/UDDI/Lite.pm
UDDI::Deserializer
in lib/UDDI/Lite.pm
UDDI::SOM
in lib/UDDI/Lite.pm
UDDI::Serializer
in lib/UDDI/Lite.pm
URI::jabber
in lib/SOAP/Transport/JABBER.pm
URI::mq
in lib/SOAP/Transport/MQ.pm
URI::tcp
in lib/SOAP/Transport/TCP.pm
XMLRPC
in lib/XMLRPC/Lite.pm
XMLRPC::Constants
in lib/XMLRPC/Lite.pm
XMLRPC::Data
in lib/XMLRPC/Lite.pm
XMLRPC::Deserializer
in lib/XMLRPC/Lite.pm
XMLRPC::SOM
in lib/XMLRPC/Lite.pm
XMLRPC::Serializer
in lib/XMLRPC/Lite.pm
XMLRPC::Server
in lib/XMLRPC/Lite.pm
XMLRPC::Server::Parameters
in lib/XMLRPC/Lite.pm
XMLRPC::Test::Server
in lib/XMLRPC/Test.pm
XMLRPC::Transport::HTTP::Apache
in lib/XMLRPC/Transport/HTTP.pm
XMLRPC::Transport::HTTP::CGI
in lib/XMLRPC/Transport/HTTP.pm
XMLRPC::Transport::HTTP::Daemon
in lib/XMLRPC/Transport/HTTP.pm
XMLRPC::Transport::POP3::Server
in lib/XMLRPC/Transport/POP3.pm
XMLRPC::Transport::TCP::Server
in lib/XMLRPC/Transport/TCP.pm

Examples

Other files