PT-2011-3910 · Shibboleth+1 · Shibboleth+1

Paulo Zanoni · Published 2011-07-11 · Updated 2023-02-13 · CVE-2011-2516

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache XML Security for C++ version 1.6.0 Shibboleth versions prior to 2.4.3

Description The issue is caused by an off-by-one error in the XML signature feature, which can be exploited by remote attackers to cause a denial of service (crash) via a signature using a large RSA key. This triggers a buffer overflow.

Recommendations For Apache XML Security for C++ version 1.6.0, update to a version that fixes the off-by-one error in the XML signature feature. For Shibboleth versions prior to 2.4.3, update to version 2.4.3 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2011-2516

DSA-2277-1

Affected Products

Apache Xml Security For C++

Shibboleth

References · 23

• 🔥 https://issues.apache.org/jira/browse/SANTUARIO-271 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2011-2516 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063159.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-2516 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-2516 · Vendor Advisory
• http://santuario.apache.org/secadv/CVE-2011-2516.txt · Vendor Advisory
• https://ubuntu.com/security/CVE-2011-2516 · Vendor Advisory
• http://debian.org/security/2011/dsa-2277 · Vendor Advisory
• http://secunia.com/advisories/45191 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2011-2516 · Security Note
• http://shibboleth.internet2.edu/secadv/secadv_20110706.txt · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063229.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2516 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-2516 · Vendor Advisory
• http://secunia.com/advisories/45151 · Vendor Advisory