2012-11-26 Instructure Advisory IAC41628 - XML Parsing Vulnerability

574

SECURITY UPDATE

Release Date:	2012-11-26 (Last update can be found below the document title)
Description:	XML Parsing Vulnerability
Criticality Level:	Highly Critical ( Less Critical < Critical < Moderately Critical < Highly Critical )
Impact:	Potential for attacker to view sensitive system information
Systems Affected:	Canvas LMS
Solution Status:	Patched in Canvas Cloud
Discovered By:	Securus Global
Relevant Changesets:	Canvas: N/A libxml2: http://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba017c6b5526070f

Summary:

An XML parsing vulnerability was discovered in libxml, the underlying library that Canvas uses for parsing incoming XML (through the Nokogiri Ruby gem). This vulnerability could allow an attacker to view sensitive system information on the application servers.

Because the bug is in libxml, there is no relevant change in Canvas itself. Users of Canvas CV are encouraged to either upgrade to libxml 2.9 or above, or apply the patch listed above manually and build new libxml packages.

About

Bio

Jordan has had various roles in the ed tech software (SAAS) industry for the past 9 years. (almost 5 years with Instructure). In his previous company he was a Client Services Manager for two years (responsible for account management, implementation, project management, and training, for each of his customers). After a year and a half he was commissioned to build a training department, all policies and procedures, and deliver training for all customers. Over the past eight years he has been in charge of conceiving, producing and deploying eLearning initiatives and strategies. He has trained over 3,000 adult learners with a wide range of technical aptitude, including K-12 Teachers, Principals, Administrators, Superintendents, Higher Ed Professors, Doctors, CTO’s, and Corporate Business Professionals and Executives. Jordan is an instructional designer and Community Manager for Instructure with a focus on connecting Canvas users with tools and resources that will help them get excited about and become proficient in utilizing the Canvas Learning Platform.