PT-2013-3564 · Apache · Apache Santuario Xml Security For C++

James Forshaw · Publicado 2013-07-01 · Atualizado 2021-09-17 · CVE-2013-2153

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Santuario XML Security for C++ versions prior to 1.7.1

Description The issue concerns the XML digital signature functionality in the xsec/dsig/DSIGReference.cpp component, allowing context-dependent attackers to reuse signatures and spoof arbitrary content via crafted Reference elements in the Signature.

Recommendations For versions prior to 1.7.1, update to version 1.7.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the XML digital signature functionality until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2013-2153

DSA-2710-1

MGASA-2013-0193

Produtos afetados

Apache Santuario Xml Security For C++

Referências · 15

• 🔥 http://santuario.apache.org/secadv.data/CVE-2013-2153.txt · Exploit
• http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0140.html · Nota
• https://osv.dev/vulnerability/CVE-2013-2153 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2013-2153 · Aviso do Fabricante
• http://svn.apache.org/viewvc/santuario/xml-security-cpp/trunk/xsec/dsig/DSIGReference.cpp?r1=1125514&r2=1493959&pathrev=1493959&diff_format=h · Correção
• http://debian.org/security/2013/dsa-2710 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2013-0193.html · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2013-0193 · Aviso do Fabricante
• https://tenable.com/security/tns-2018-15 · Nota
• https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E · Nota
• https://bugs.mageia.org/show_bug.cgi?id=10563 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2153 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-2153 · Nota de Segurança
• https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E · Nota
• http://santuario.apache.org/secadv.html · Nota