GitHub Advisory DatabaseGHSA-8HFM-837H-HJG5Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.973 High
EPSS
Percentile
99.9%
The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in multiple products.
The Apache XML Security (Java) is affected by the vulnerability published in US-Cert VU #466161. See: http://www.kb.cert.org/vuls/id/466161 for more information. This bug can allow an attacker to bypass authentication by inserting/modifying a small HMAC truncation length parameter in the XML Signature HMAC based SignatureMethod algorithms.
An inexhaustive list of additional affected products includes:
- the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM;
- the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6;
- Mono before 2.4.2.2;
- XML Security Library before 1.2.12;
- IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1;
- Sun JDK and JRE Update 14 and earlier;
- Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.apache.santuario:xmlsec | lt | 1.4.3 |
References
www.us-cert.gov/cas/techalerts/TA10-159B.html
bugzilla.redhat.com/show_bug.cgi?id=511915
docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041
github.com/advisories/GHSA-8hfm-837h-hjg5
gitlab.gnome.org/Archive/xmlsec/-/commit/34b349675af9f72eb822837a8772cc1ead7115c7
issues.apache.org/bugzilla/show_bug.cgi?id=47526
issues.apache.org/bugzilla/show_bug.cgi?id=47527
lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html
marc.info/?l=bugtraq&m=125787273209737&w=2
nvd.nist.gov/vuln/detail/CVE-2009-0217
rhn.redhat.com/errata/RHSA-2009-1428.html
svn.apache.org/viewvc?revision=794013&view=revision
www.debian.org/security/2010/dsa-1995
www.gentoo.org/security/en/glsa/glsa-201408-19.xml
www.kb.cert.org/vuls/id/466161
www.kb.cert.org/vuls/id/MAPG-7TSKXQ
www.kb.cert.org/vuls/id/WDON-7TY529
www.mandriva.com/security/advisories?name=MDVSA-2009:209
www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html
www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html
www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html
www.redhat.com/support/errata/RHSA-2009-1694.html
www.ubuntu.com/usn/USN-903-1
www.us-cert.gov/cas/techalerts/TA09-294A.html
www.w3.org/2008/06/xmldsigcore-errata.html#e03
www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html
Related
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.973 High
EPSS
Percentile
99.9%