Apache Axis2/C SSL证书验证安全绕过漏洞

BUGTRAQ ID: 57267 CVECAN ID: CVE-2012-6107 Axis2是一个用C语言实现的Web服务引擎。 Apache Axis2/C在实现上存在安全绕过漏洞，成功利用后可允许攻击者执行中间人攻击或模拟受信任的服务器。 0 Apache Group Axis2/C 厂商补丁： Apache Group ------------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://httpd.apache.org/...

Axis2 -- Security vulnerabilities on dependency Apache HttpClient

Apache Axis2 reports: Apache Axis2 1.7.4 is a maintenance release that includes fixes for several issues, including the following security issues: Session fixation AXIS2-4739 and XSS AXIS2-5683 vulnerabilities affecting the admin console. A dependency on an Apache HttpClient version affected by...

CVE-2012-5785

Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Code injection

Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5785: Improper Input Validation

Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-4418

Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...

CVE-2012-5351

Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418...

Authentication flaw

Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418...

Authentication flaw

Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...

CVE-2012-4418

CVE-2012-4418 concerns Apache Axis2 and its XML signature handling. The provided connected material confirms that this vulnerability arises from the failure to properly verify signed XML messages, allowing an attacker to craft messages that bypass authentication via an XML Signature wrapping atta...

CVE-2012-5351

CVE-2012-5351 affects Apache Axis2 and allows remote attackers to bypass authentication by forging a SAML assertion that lacks a Signature element (Signature exclusion attack). This is the same family as CVE-2012-4418 and enables message forgery without proper XML-signature verification. IBM-rela...

CVE-2012-4418

Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...

CVE-2012-5351

Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418...

CVE-2012-4418: Improper Authentication

Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...

CVE-2012-5351: Improper Authentication

Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418...

Apache Axis2 XML signature-wrapping安全漏洞

Apache Axis2是Apache web services/SOAP/WDSL引擎，它是Apache SOAP项目的延续。 Apache Axis2受XML Signature Wrapping XSW攻击影响，允许攻击者利用漏洞绕过对签名请求的验证，对应用进行进一步攻击。 0 Apache Axis2 厂商解决方案 目前没有详细解决方案提供： http://ws.apache.org/axis/...

Apache Axis2 File Disclosure

File disclosure vulnerability Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

http-axis2-dir-traversal NSE Script

Exploits a directory traversal vulnerability in Apache Axis2 version 1.4.1 by sending a specially crafted request to the parameter xsd BID 40343. By default it will try to retrieve the configuration file of the Axis2 service '/conf/axis2.xml' using the path '/axis2/services/' to return the userna...

Apache Axis2 code execution

Default account...

CA ARCserve D2D r15 - Web Service Servlet Code Execution

CA ARCserve D2D r15 - Web Service Servlet Code Execution Computer Associates ARCserve D2D r15 Web Service Apache Axis2 World Accessible Servlet Code Execution Vulnerability Poc product homepage: https://support.ca.com/phpdocs/0/8363/support/arcserved2dsupport.html vulnerability: The Tomcat Server...