full-disclosure - CVE-2013-2155: Apache Santuario C++ denial of service vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BA63CEAE152A7742B854C678D9491383945E53E7@CIO-KRC-D1MBX01.osuad.osu.edu>
Date: Tue, 18 Jun 2013 03:48:12 +0000
From: "Cantor, Scott" <cantor.2@....edu>
To: "security@...che.org" <security@...che.org>,
 "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
 "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: CVE-2013-2155: Apache Santuario C++ denial of
	service vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

CVE-2013-2155: Apache Santuario XML Security for C++ contains denial
of service and hash length bypass issues while processing HMAC signatures

Severity: Critical

Vendor: The Apache Software Foundation

Versions Affected: Apache Santuario XML Security for C++ library versions
prior to V1.7.1

Description: A bug exists in the processing of the output length of an
HMAC-based XML Signature that would cause a denial of service when
processing specially chosen input. Exploitation of this issue does
not require authenticated content.

In very unusual cases, inputs could be chosen in such a way that
the fix for the issue in CVE-2009-0217 could be bypassed, enabling
improper verification of a signature.

Mitigation: Applications that support HMAC signatures and are using library
versions older than V1.7.1 should upgrade as soon as possible. Distributors
of older versions should apply the patches from this subversion revision:

http://svn.apache.org/viewvc?view=revision&revision=1493960

Credit: This issue was reported by James Forshaw, Context Information
Security

References: http://santuario.apache.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (Darwin)

iQIcBAEBCgAGBQJRv9gDAAoJEDeLhFQCJ3likjsP/2VC0FXAO39JWYLBPt8o48+Z
rwy0SFlqZrjcLkeC9dRvzw/EDItagyP+ir2raJhbIMzyLgHA/GSYolcrFVr5OEjK
sHXimW3c85bkjC9ygTyfXoXljwV3BNNjKvJ9ELDbt7LAVBxP/ngYIP49Ai9cGbLv
eLuvTs+GaFVUcA9w+fhyQEbIczhOhbtPM3ltugzQpLdu+xbpwkrvXL7Pge1U7KLg
9T23HpzEt/ye+RK/wih/0XntrSyHKqs1oPtyU6E8KZUFlRMFIZ541G933OVrt/HG
jdNH+0usEd3DzaCNtxf1lopLsVaPgbYcp1jOO2+JCQ97pLqtpL9qq/6asGtYViuT
lWt8hPispI6D00IDo+7iuuEokOlo3dWAJI9QZjRqYIPFE+rVHBNgUezYHv6d8Woc
Z1WWrFkCZEJhmqAylkHKHaEDPPiCINwtbzGRxFOBWuhU7Bcf1tdKDzGChyZVKz/l
A5IEQYw6pagSv8mMMhDOzKzJZSgH5mGQBmBwQ014/4/noD8zMdSsrQ/RRxmzpX9C
jIWVasOtpHQy/IJTjdjQcF4ZJvBz40i3VVQwhxHnYtl6NJXr1bGzqlC01G7nWWsG
dcBSB4MnNu+uYnev7CzlC4EZ27j2HgekmJ7GPWqKKj5R7rAFlsxjo50g1J7CUsJ3
g2CPt8V/THNSVKr26Hrz
=Z6W/
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/