CVE-2013-2155: Apache Santuario C++ denial of service vulnerability

2013-07-01T00:00:00
ID SECURITYVULNS:DOC:29495
Type securityvulns
Reporter Securityvulns
Modified 2013-07-01T00:00:00

Description

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

CVE-2013-2155: Apache Santuario XML Security for C++ contains denial of service and hash length bypass issues while processing HMAC signatures

Severity: Critical

Vendor: The Apache Software Foundation

Versions Affected: Apache Santuario XML Security for C++ library versions prior to V1.7.1

Description: A bug exists in the processing of the output length of an HMAC-based XML Signature that would cause a denial of service when processing specially chosen input. Exploitation of this issue does not require authenticated content.

In very unusual cases, inputs could be chosen in such a way that the fix for the issue in CVE-2009-0217 could be bypassed, enabling improper verification of a signature.

Mitigation: Applications that support HMAC signatures and are using library versions older than V1.7.1 should upgrade as soon as possible. Distributors of older versions should apply the patches from this subversion revision:

http://svn.apache.org/viewvc?view=revision&revision=1493960

Credit: This issue was reported by James Forshaw, Context Information Security

References: http://santuario.apache.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (Darwin)

iQIcBAEBCgAGBQJRv9gDAAoJEDeLhFQCJ3likjsP/2VC0FXAO39JWYLBPt8o48+Z rwy0SFlqZrjcLkeC9dRvzw/EDItagyP+ir2raJhbIMzyLgHA/GSYolcrFVr5OEjK sHXimW3c85bkjC9ygTyfXoXljwV3BNNjKvJ9ELDbt7LAVBxP/ngYIP49Ai9cGbLv eLuvTs+GaFVUcA9w+fhyQEbIczhOhbtPM3ltugzQpLdu+xbpwkrvXL7Pge1U7KLg 9T23HpzEt/ye+RK/wih/0XntrSyHKqs1oPtyU6E8KZUFlRMFIZ541G933OVrt/HG jdNH+0usEd3DzaCNtxf1lopLsVaPgbYcp1jOO2+JCQ97pLqtpL9qq/6asGtYViuT lWt8hPispI6D00IDo+7iuuEokOlo3dWAJI9QZjRqYIPFE+rVHBNgUezYHv6d8Woc Z1WWrFkCZEJhmqAylkHKHaEDPPiCINwtbzGRxFOBWuhU7Bcf1tdKDzGChyZVKz/l A5IEQYw6pagSv8mMMhDOzKzJZSgH5mGQBmBwQ014/4/noD8zMdSsrQ/RRxmzpX9C jIWVasOtpHQy/IJTjdjQcF4ZJvBz40i3VVQwhxHnYtl6NJXr1bGzqlC01G7nWWsG dcBSB4MnNu+uYnev7CzlC4EZ27j2HgekmJ7GPWqKKj5R7rAFlsxjo50g1J7CUsJ3 g2CPt8V/THNSVKr26Hrz =Z6W/ -----END PGP SIGNATURE-----