CVE-2012-6702

What it actually does

When XML_SetHashSalt is not called or is passed a zero seed, Expat relies on the default srand seeding behavior for internal hash functions, allowing predictable hash values that can be abused to cause collisions and defeat integrity protections in dependent parsers.

Why it matters to the business

Applications that parse untrusted XML may silently accept tampered data or bypass security checks, increasing the risk of data corruption or unauthorized actions without requiring direct code changes in the affected products.

How an attack unfolds

An attacker supplies specially crafted XML input to a parser that has not initialized Expat's hash salt; because srand is called without a strong seed, the attacker can pre-compute or guess the resulting hash values, forcing collisions that undermine any integrity or anti-tampering mechanisms built on top of the parser.

How to fix it

Update to a version of libexpat that enforces or documents safe use of XML_SetHashSalt with a non-zero seed; rebuild and redeploy all dependent packages on Ubuntu, Debian, and Android with the patched library; where source changes are possible, explicitly call XML_SetHashSalt with a cryptographically random value before parsing.

How to confirm the fix worked

Review application or library initialization code for the presence of XML_SetHashSalt calls with non-zero seeds; recompile test parsers with the updated library and confirm that identical malicious XML inputs now produce different hash behavior or are rejected; scan build artifacts for the vulnerable Expat version strings.

Typical attack path

1. Identify a target application or service that uses libexpat without calling XML_SetHashSalt
2. Craft malicious XML payloads designed to trigger hash collisions in the parser's internal tables
3. Submit the payload over the network or via file upload to the affected parser
4. Observe or force acceptance of tampered content that should have been rejected by integrity checks

How to detect it

Examine application logs and XML parser initialization traces for missing or zero-value salt configuration; look for repeated parsing of XML documents that would normally trigger integrity failures; review process startup for calls to srand without preceding entropy gathering in any Expat-dependent binary.

What your security team should do

• Prioritize patching libexpat in all server-side XML processing pipelines due to the network attack vector
• Add static analysis or dependency checks to ensure XML_SetHashSalt is invoked with a strong seed in new code
• Monitor EPSS and exploit maturity indicators for any future increase in observed exploitation attempts