PT-2009-6690 · Oracle+6 · Sun Jdk/Jre+8

Scott Cantor · Published 1970-01-01 · Updated 2022-05-02 · CVE-2009-0217

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions XML Security Library versions prior to 1.2.12 Mono versions prior to 2.4.2.2 IBM WebSphere Application Server versions prior to 6.0.2.33, 6.1.0.23, and 7.0.0.1 Oracle Application Server versions 10.1.2.3, 10.1.3.4, and 10.1.4.3IM Oracle WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6 Microsoft .NET Framework versions 3.0 through 3.0 SP2, 3.5, and 4.0 Sun JDK and JRE Update 14 and earlier

Description The vulnerability is related to the W3C XML Signature Syntax and Processing recommendation, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits. This can lead to data tampering and disruption of protected information. The vulnerability can be exploited remotely.

Recommendations For XML Security Library versions prior to 1.2.12, update to version 1.2.12 or later. For Mono versions prior to 2.4.2.2, update to version 2.4.2.2 or later. For IBM WebSphere Application Server versions prior to 6.0.2.33, 6.1.0.23, and 7.0.0.1, update to the latest version. For Oracle Application Server versions 10.1.2.3, 10.1.3.4, and 10.1.4.3IM, update to the latest version. For Oracle WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6, update to the latest version. For Microsoft .NET Framework versions 3.0 through 3.0 SP2, 3.5, and 4.0, update to the latest version. For Sun JDK and JRE Update 14 and earlier, update to the latest version. As a temporary workaround, consider restricting access to HMAC-based signature methods until a patch is available.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

BDU:2015-02869

BDU:2015-02870

BDU:2015-02871

BDU:2015-02872

CVE-2009-0217

DSA-1849-1

DSA-1995-1

DTSA-205-1

GHSA-8HFM-837H-HJG5

HPSBUX02476

RHSA-2009:1200

RHSA-2009:1201

RHSA-2009:1428

RHSA-2009:1636

RHSA-2009:1637

RHSA-2009:1649

RHSA-2009:1650

RHSA-2009:1694

RHSA-2009_1201

RHSA-2009_1428

RHSA-2010:0043

Affected Products

.Net Framework

Hp-Ux

Ibm Websphere Application Server

Mono

Oracle Application Server

Oracle Weblogic Server

Red Hat

Sun Jdk/Jre

Xml Security Library

References · 143

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2676 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2673 · Security Note
• https://bdu.fstec.ru/vul/2015-02869 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-August/msg00325.html · Vendor Advisory
• http://securityfocus.com/bid/35671 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2670 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2675 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1 · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2009-1200.html · Vendor Advisory
• http://secunia.com/advisories/35858 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2674 · Security Note
• http://secunia.com/advisories/35855 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041 · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2009-1636.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1 · Vendor Advisory