Google epub checker software#
“The software uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.” states the advisory published by the. The Google Play Books service was not affected by the XXE flaw, but the expert discovered the possibility to trigger an XML Entity expansion flaw that could be exploited to cause denial of service through an explosive growth of parsed data.
Google epub checker password#
This issue was addressed through improved parsing. CVE-2016-7666: Craig Arendt of Stratum Security” state the advisory published by Apple.Īrendt confirmed that during the test he accidentally grabbed the shadow password file for one of the epub services using the vulnerable EpubCheck library. “Parsing maliciously crafted EPUB may lead to disclosure of user informationĭescription: An information disclosure issue existed in the parsing of EPUB. “The validator tool (EpubCheck) was vulnerable to XXE, so any application that relies on a vulnerable version to check the validity of a book would be susceptible to this type of attack.” continues the analysis.Īrendt explained that in the case of Amazon, the KDP Kindle file upload service used to help publishers upload their books was affected by an XXE flaw that could be exploited by attackers to steal books and data.Ī similar flaw affected the Apple Transporter service that ships books to the App Store. Publishers perform a validation step using the library to verify that the format is valid and Arendt discovered the XML external entity (XXE) issue. The researcher focused its tests the tool/Java library called EpubCheck (provided by IDPF) used to validate books in the ePub format. Their membership list: ” reads a blog post published by Arendt. IDPF is a trade and standards association for the digital publishing industry, set up to establish a standard for ebook publishing. “ePub is a standard format for open books maintained by IDPF (International Digital Publishing Forum). Exploiting vulnerabilities in EpubCheck <= 4.0.1 (ePub Validation Java Library & tool), Adobe Digital Editions <= 4.5.2 (book reader), Amazon KDP (Kindle Publishing Online Service), Apple Transporter, and Google Play Book uploads, etc.” “Applying a familiar XXE pattern to exploit services & readers that consume the ePUB format. The library is used for the operations of format conversions into the universal Epub book format. BookRix will produce technically efficient eBook files (ePub, mobi etc.The expert discovered different XML external entity (XXE) vulnerabilities in the online epub ebook services that use leverages the ‘EpubCheck’ library. When you choose to publish and distribute your eBook using our BookRix Self-Publishing-Service, we take ownership of proper conversion so you don’t have to worry about the technical aspect. If you’re tech savvy and want to go through the creation and ePub conversion process, we recommend using “Calibre” software. Once available, your ePub file can be downloaded by you, and others, if enabled. When you create an eBook on BookRix using our eBook editor, a valid ePub file will be automatically generated for you.
If an error is detected during the ePub check, we will advise you on what needs to be modified, which will simplify your ePub corrections. Our ePub validation tool listed above allows you to validate the accuracy of your ePub file. ePub errors can cause content to be displayed incorrectly on eReader devices.
Problems can occur if an error is made during the ePub creation/conversion. The ePub validation process acts as a test to ensure the ePub file adheres to these standards. In order for an ePub file to be opened, displayed and read properly on all devices, it must meet standard technical requirements. EPub is a standard file format for eBooks that can be read on a variety of devices (eReaders, Tablets, Smartphones, etc.).
0 kommentar(er)
