PT-2017-6709 · Netlock · Netlock Mokka

Publicado 2017-07-21 · Atualizado 2017-07-26 · CVE-2015-3932

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Netlock Mokka versions prior to 2.7.8.1204

Description The issue allows remote attackers to perform XML signature wrapping attacks. This can be achieved via an e-akta signed document with a ds:Object node that contains a crafted payload prepended to a valid ds:Object.

Recommendations For versions prior to 2.7.8.1204, update to version 2.7.8.1204 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-91

Identificadores relacionados

CVE-2015-3932

Produtos afetados

Netlock Mokka

Referências · 6

• https://search-lab.hu/about-us/news/107-37-million-digitally-signed-documents-had-to-be-reverified · Nota
• http://neih.gov.hu/?q=node/66 · Nota
• http://packetstormsecurity.com/files/132473/Microsec-e-Szigno-Netlock-Mokka-XML-Signature-Wrapping.html · Nota
• https://search-lab.hu/eakta · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-3932 · Nota de Segurança
• http://securityfocus.com/bid/75489 · Nota