Integration


This is an IBM Automation portal for Integration products. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (https://ideas.ibm.com).


Shape the future of IBM!

We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:

Search existing ideas

Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updates on them if they matter to you. If you can't find what you are looking for,

Post your ideas

  1. Post an idea.

  2. Get feedback from the IBM team and other customers to refine your idea.

  3. Follow the idea through the IBM Ideas process.


Specific links you will want to bookmark for future use

Welcome to the IBM Ideas Portal (https://www.ibm.com/ideas) - Use this site to find out additional information and details about the IBM Ideas process and statuses.

IBM Unified Ideas Portal (https://ideas.ibm.com) - Use this site to view all of your ideas, create new ideas for any IBM product, or search for ideas across all of IBM.

ideasibm@us.ibm.com - Use this email to suggest enhancements to the Ideas process or request help from IBM for submitting your Ideas.


Add a new idea Subscribe
Status Delivered
Workspace App Connect
Created by Guest
Created on Mar 5, 2012

RELATED IDEAS

WMB configurable option to disable DTD processing. This in order to prevent XML BOMB attacks

Currently, it is possible to send a simple DTD “XML BOMB” (recursive validation) message to any flow that parses XML, thereby putting the broker machine on 100% CPU for about 10 minutes and denying service to that flow. Although we haven't tried it yet, I imagine sending a few such messages will deny service to the entire broker due and might result in a forced restart.

This basically means that any broker with just one non-SSL flow is vulnerable to one of the most common and simplest attacks in the book, which will result in serious DOS or might even cause the machine to crash.

Proposed solution:
Have some sort of binary parameter – possibly configurable per-execution group – that makes all flows completely ignore DTD declarations. This should apply to all parsers – XML, XMLNS, XMLNSC, MRM, DFDL, etc.

Since most sites haven't used DTD in years (switched to .xsd validation long ago...) this shouldn't present a problem.

An example of an xml bomb can be found here:
http://msdn.microsoft.com/en-us/magazine/ee335713.aspx
We've used a similar example for our tests.

Idea priority Medium
RFE ID 19454
RFE URL
RFE Product IBM App Connect Enterprise (formerly IBM Integration Bus)
  • Admin
    Ben Thompson
    Reply
    |     Jul 14, 2021

    Idea / RFE review. Apologies for the length of time this idea has been in the status of Uncommitted Candidate / Future Consideration. The ability to protect from this vulnerability has been added to the product via an upgrade to the XML4C component, which is mentioned in the security bulletin here: https://www.ibm.com/support/pages/node/282711

    The environment variable "XERCES_DISABLE_DTD" can be used to turn on this capability. Status of the idea is updated to Delivered.

  • Guest
    Reply
    |     Oct 7, 2015

    Due to processing by IBM, this request was reassigned to have the following updated attributes:
    Brand - WebSphere
    Product family - Integration
    Product - IBM Integration Bus (WebSphere Message Broker) - IIB

    For recording keeping, the previous attributes were:
    Brand - WebSphere
    Product family - Connectivity and Integration
    Product - IBM Integration Bus (WebSphere Message Broker) - IIB

  • Guest
    Reply
    |     Apr 4, 2012

    This is a good request; thanks for raising. We currently recommend that, for untrusted services, the Broker is hosted inside a secured back-end environment, with a suitable system in place (e.g. DataPower XS40) that can perform DoS protection before forwarding workloads on.

By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.