BugTraq
CVE-2013-2153: Apache Santuario C++ signature bypass vulnerability Jun 18 2013 03:43AM
Cantor, Scott (cantor 2 osu edu) (2 replies)
CVE-2013-2155: Apache Santuario C++ denial of service vulnerability Jun 18 2013 03:48AM
Cantor, Scott (cantor 2 osu edu) (1 replies)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

CVE-2013-2155: Apache Santuario XML Security for C++ contains denial
of service and hash length bypass issues while processing HMAC signatures

Severity: Critical

Vendor: The Apache Software Foundation

Versions Affected: Apache Santuario XML Security for C++ library versions
prior to V1.7.1

Description: A bug exists in the processing of the output length of an
HMAC-based XML Signature that would cause a denial of service when
processing specially chosen input. Exploitation of this issue does
not require authenticated content.

In very unusual cases, inputs could be chosen in such a way that
the fix for the issue in CVE-2009-0217 could be bypassed, enabling
improper verification of a signature.

Mitigation: Applications that support HMAC signatures and are using library
versions older than V1.7.1 should upgrade as soon as possible. Distributors
of older versions should apply the patches from this subversion revision:

http://svn.apache.org/viewvc?view=revision&revision=1493960

Credit: This issue was reported by James Forshaw, Context Information
Security

References: http://santuario.apache.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (Darwin)

iQIcBAEBCgAGBQJRv9gDAAoJEDeLhFQCJ3likjsP/2VC0FXAO39JWYLBPt8o48+Z
rwy0SFlqZrjcLkeC9dRvzw/EDItagyP+ir2raJhbIMzyLgHA/GSYolcrFVr5OEjK
sHXimW3c85bkjC9ygTyfXoXljwV3BNNjKvJ9ELDbt7LAVBxP/ngYIP49Ai9cGbLv
eLuvTs+GaFVUcA9w+fhyQEbIczhOhbtPM3ltugzQpLdu+xbpwkrvXL7Pge1U7KLg
9T23HpzEt/ye+RK/wih/0XntrSyHKqs1oPtyU6E8KZUFlRMFIZ541G933OVrt/HG
jdNH+0usEd3DzaCNtxf1lopLsVaPgbYcp1jOO2+JCQ97pLqtpL9qq/6asGtYViuT
lWt8hPispI6D00IDo+7iuuEokOlo3dWAJI9QZjRqYIPFE+rVHBNgUezYHv6d8Woc
Z1WWrFkCZEJhmqAylkHKHaEDPPiCINwtbzGRxFOBWuhU7Bcf1tdKDzGChyZVKz/l
A5IEQYw6pagSv8mMMhDOzKzJZSgH5mGQBmBwQ014/4/noD8zMdSsrQ/RRxmzpX9C
jIWVasOtpHQy/IJTjdjQcF4ZJvBz40i3VVQwhxHnYtl6NJXr1bGzqlC01G7nWWsG
dcBSB4MnNu+uYnev7CzlC4EZ27j2HgekmJ7GPWqKKj5R7rAFlsxjo50g1J7CUsJ3
g2CPt8V/THNSVKr26Hrz
=Z6W/
-----END PGP SIGNATURE-----

[ reply ]
Re: CVE-2013-2156: Apache Santuario C++ heap overflow vulnerability Jun 18 2013 03:49AM
Cantor, Scott (cantor 2 osu edu)
CVE-2013-2154: Apache Santuario C++ stack overflow vulnerability Jun 18 2013 03:44AM
Cantor, Scott (cantor 2 osu edu)


 

Privacy Statement
Copyright 2010, SecurityFocus