1736
Reference Description
https://www.cve.org/CVERecord?id=CVE-2009-3547
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1415 Comprehensive Categorization: Resource Control 1400 2544
Notes
Research Gap
Under-studied and under-reported as of September 2010. This weakness has been reported
in high-visibility software, although the focus has been primarily on memory allocation and deallocation.
There are very few examples of this weakness that are not directly related to memory
management, although such weaknesses are likely to occur in real-world software for other types
of resources.
CWE-827: Improper Control of Document Type Definition
Weakness ID : 827
Structure : Simple
Abstraction : Variant
Description
The product does not restrict a reference to a Document Type Definition (DTD) to the intended
control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product
to expose files, consume excessive system resources, or execute arbitrary http requests on behalf
of the attacker.
Extended Description
As DTDs are processed, they might try to read or include files on the machine performing the
parsing. If an attacker is able to control the DTD, then the attacker might be able to specify
sensitive resources or requests or provide malicious content.
For example, the SOAP specification prohibits SOAP messages from containing DTDs.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 829 Inclusion of Functionality from Untrusted Control Sphere 1741
ChildOf 706 Use of Incorrectly-Resolved Name or Reference 1544
CanPrecede 776 Improper Restriction of Recursive Entity References in
DTDs ('XML Entity Expansion')