PT-2017-6709 · Netlock · Netlock Mokka

Published 2017-07-21 · Updated 2017-07-26 · CVE-2015-3932

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Netlock Mokka versions prior to 2.7.8.1204

Description The issue allows remote attackers to perform XML signature wrapping attacks. This can be achieved via an e-akta signed document with a ds:Object node that contains a crafted payload prepended to a valid ds:Object.

Recommendations For versions prior to 2.7.8.1204, update to version 2.7.8.1204 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-91

Related Identifiers

CVE-2015-3932

Affected Products

Netlock Mokka

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-3932 · Security Note
• https://search-lab.hu/about-us/news/107-37-million-digitally-signed-documents-had-to-be-reverified · Note
• http://neih.gov.hu/?q=node/66 · Note
• http://packetstormsecurity.com/files/132473/Microsec-e-Szigno-Netlock-Mokka-XML-Signature-Wrapping.html · Note
• https://search-lab.hu/eakta · Note
• http://securityfocus.com/bid/75489 · Note