bugtraq - Security Advisory: CVE-2011-2516

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 7 Jul 2011 00:58:06 +0000
From: "Cantor, Scott E." <cantor.2@....edu>
To: "dev@...tuario.apache.org" <dev@...tuario.apache.org>
Cc: "security@...che.org" <security@...che.org>,
  "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
  "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: Security Advisory: CVE-2011-2516

Please be advised that a security issue affecting the Apache XML Security
Library for C++ has been identified and an updated version released to
address the issue. The full text of the advisory is below, and a signed
version can be found at:

http://santuario.apache.org/secadv/CVE-2011-2516.txt

-- Scott Cantor

CVE-2011-2516: Apache Santuario XML Security for C++ contains buffer
overflows signing or verifying with large keys.

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: Apache Santuario XML Security for C++ library versions
prior to V1.6.1

Description: A buffer overflow exists when creating or verifying XML
signatures
with RSA keys of sizes on the order of 8192 or more bits. This typically
results
in a crash and denial of service in applications that verify signatures
using
keys that could be supplied by an attacker.

Mitigation: Applications using library versions older than V1.6.1 should
upgrade
as soon as possible. Distributors of older versions should apply the
patches
from this subversion revision:

http://svn.apache.org/viewvc?view=revision&revision=1125752

Applications that can prevent the use of arbitrary keys supplied by an
attacker
(such as within the ds:KeyInfo element of a signature), or limit key
sizes, may
prevent the exploitation of this bug.

Credit: This issue was reported by Paulo Zanoni.

References: http://santuario.apache.org/

Scott Cantor