PT-2011-3910 · Shibboleth+1 · Shibboleth+1

Paulo Zanoni · Publicado 2011-07-11 · Atualizado 2023-02-13 · CVE-2011-2516

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache XML Security for C++ version 1.6.0 Shibboleth versions prior to 2.4.3

Description The issue is caused by an off-by-one error in the XML signature feature, which can be exploited by remote attackers to cause a denial of service (crash) via a signature using a large RSA key. This triggers a buffer overflow.

Recommendations For Apache XML Security for C++ version 1.6.0, update to a version that fixes the off-by-one error in the XML signature feature. For Shibboleth versions prior to 2.4.3, update to version 2.4.3 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2011-2516

DSA-2277-1

Produtos afetados

Apache Xml Security For C++

Shibboleth

Referências · 23

• 🔥 https://issues.apache.org/jira/browse/SANTUARIO-271 · Exploit
• http://secunia.com/advisories/45198 · Nota
• http://secunia.com/advisories/45491 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/68420 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2011-2516 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063159.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2011-2516 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2011-2516 · Aviso do Fabricante
• http://securityfocus.com/bid/48611 · Nota
• http://santuario.apache.org/secadv/CVE-2011-2516.txt · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2011-2516 · Aviso do Fabricante
• http://debian.org/security/2011/dsa-2277 · Aviso do Fabricante
• http://secunia.com/advisories/45191 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2011-2516 · Nota de Segurança
• http://shibboleth.internet2.edu/secadv/secadv_20110706.txt · Aviso do Fabricante