Question

In the documentation for securely consuming web services with WCF they state that it is recommended that you prohibit the DTD when consuming the metadata. Why is the DTD a security risk?

http://msdn.microsoft.com/en-us/library/ms734741.aspx

Answer 1

http://msdn.microsoft.com/en-us/magazine/ee335713.aspx

The easiest way to defend against all types of XML entity attacks is
to simply disable altogether the use of inline DTD schemas in your XML
parsing objects. This is a straightforward application of the
principle of attack surface reduction: if you’re not using a feature,
turn it off so that attackers won’t be able to abuse it.