lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <BA63CEAE152A7742B854C678D9491383945E53E7@CIO-KRC-D1MBX01.osuad.osu.edu> Date: Tue, 18 Jun 2013 03:48:12 +0000 From: "Cantor, Scott" <cantor.2@....edu> To: "security@...che.org" <security@...che.org>, "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>, "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com> Subject: CVE-2013-2155: Apache Santuario C++ denial of service vulnerability -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 CVE-2013-2155: Apache Santuario XML Security for C++ contains denial of service and hash length bypass issues while processing HMAC signatures Severity: Critical Vendor: The Apache Software Foundation Versions Affected: Apache Santuario XML Security for C++ library versions prior to V1.7.1 Description: A bug exists in the processing of the output length of an HMAC-based XML Signature that would cause a denial of service when processing specially chosen input. Exploitation of this issue does not require authenticated content. In very unusual cases, inputs could be chosen in such a way that the fix for the issue in CVE-2009-0217 could be bypassed, enabling improper verification of a signature. Mitigation: Applications that support HMAC signatures and are using library versions older than V1.7.1 should upgrade as soon as possible. Distributors of older versions should apply the patches from this subversion revision: http://svn.apache.org/viewvc?view=revision&revision=1493960 Credit: This issue was reported by James Forshaw, Context Information Security References: http://santuario.apache.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (Darwin) iQIcBAEBCgAGBQJRv9gDAAoJEDeLhFQCJ3likjsP/2VC0FXAO39JWYLBPt8o48+Z rwy0SFlqZrjcLkeC9dRvzw/EDItagyP+ir2raJhbIMzyLgHA/GSYolcrFVr5OEjK sHXimW3c85bkjC9ygTyfXoXljwV3BNNjKvJ9ELDbt7LAVBxP/ngYIP49Ai9cGbLv eLuvTs+GaFVUcA9w+fhyQEbIczhOhbtPM3ltugzQpLdu+xbpwkrvXL7Pge1U7KLg 9T23HpzEt/ye+RK/wih/0XntrSyHKqs1oPtyU6E8KZUFlRMFIZ541G933OVrt/HG jdNH+0usEd3DzaCNtxf1lopLsVaPgbYcp1jOO2+JCQ97pLqtpL9qq/6asGtYViuT lWt8hPispI6D00IDo+7iuuEokOlo3dWAJI9QZjRqYIPFE+rVHBNgUezYHv6d8Woc Z1WWrFkCZEJhmqAylkHKHaEDPPiCINwtbzGRxFOBWuhU7Bcf1tdKDzGChyZVKz/l A5IEQYw6pagSv8mMMhDOzKzJZSgH5mGQBmBwQ014/4/noD8zMdSsrQ/RRxmzpX9C jIWVasOtpHQy/IJTjdjQcF4ZJvBz40i3VVQwhxHnYtl6NJXr1bGzqlC01G7nWWsG dcBSB4MnNu+uYnev7CzlC4EZ27j2HgekmJ7GPWqKKj5R7rAFlsxjo50g1J7CUsJ3 g2CPt8V/THNSVKr26Hrz =Z6W/ -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists