Vulnerability Bulletins |
Vulnerabilidad en W3C XML Signature Syntax and Processing (XMLDsig) |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Aumento de privilegios |
| Dificulty | Experto |
| Required attacker level | Acceso remoto sin cuenta a un servicio estandar |
System information |
|
| Property | Value |
| Affected manufacturer | Microsoft |
| Affected software |
Oracle Application Server 10.1.2.3, 10.1.3.4, y 10.1.4.3 IBM WebLogic Server 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6 Mono < 2.4.2.2 XML Security Library < 1.2.12 IBM WebSphere Application Server 6.0 a 6.0.2.33, 6.1 a 6.1.0.23, y 7.0 a 7.0.0.1 Sun JDK y JRE Update <= 14 |
Description |
|
|
Se ha descubierto una vulnerabilidad en la implementación de W3C XML Signature Syntax and Processing (XMLDsig). La vulnerabilidad reside en un error en la utilización de un parámetro que define una longitud de truncamiento HMAC (HMACOutputLength), que no requiere un mínimo de longitud. Un atacante remoto podría suplantar firmas HMAC y saltarse restricciones de autenticación especificando una longitud con un número pequeño de bits. |
|
Solution |
|
|
Actualización de software Microsoft (MS10-041) Microsoft Windows 2000 SP4 / Microsoft .NET Framework 1.1 SP1 / patch NDP1.1sp1-KB979906-X86 Windows XP SP2 y SP3 / Microsoft .NET Framework 1.0 SP3 / patch NDP1.0sp3-KB979904-X86-Ocm-Enu Windows XP SP2 y SP3 / Microsoft .NET Framework 1.1 SP1 / patch NDP1.1sp1-KB979906-X86 Windows XP Professional x64 SP2 / Microsoft .NET Framework 1.1 Service Pack 1 / patch NDP1.1sp1-KB979906-X86 Windows Server 2003 SP2 / Microsoft .NET Framework 1.1 Service Pack 1 / patch WindowsServer2003-KB979907-x86-ENU Windows Server 2003 x64 SP2 / Microsoft .NET Framework 1.1 Service Pack 1 / patch NDP1.1sp1-KB979906-X86 Windows Server 2003 SP2 Itanium-based / Microsoft .NET Framework 1.1 Service Pack 1 / patch NDP1.1sp1-KB979906-X86 Windows Vista SP1 y SP2 / Microsoft .NET Framework 1.1 Service Pack 1 / patch NDP1.1sp1-KB979906-X86 Windows Vista x64 SP1 y SP2 / Microsoft .NET Framework 1.1 Service Pack 1 / patch NDP1.1sp1-KB979906-X86 Windows Server 2008 32-bit SP2 / Microsoft .NET Framework 1.1 Service Pack 1 / patch NDP1.1sp1-KB979906-X86 Windows Server 2008 x64 SP2 / Microsoft .NET Framework 1.1 Service Pack 1 / patch NDP1.1sp1-KB979906-X86 Windows Server 2008 Itanium-based SP2 / Microsoft .NET Framework 1.1 Service Pack 1 / patch NDP1.1sp1-KB979906-X86 http://www.microsoft.com/downloads |
|
Standar resources |
|
| Property | Value |
| CVE | CVE-2009-0217 |
| BID | 35671 |
Other resources |
|
|
Microsoft Security Bulletin (MS10-041) http://www.microsoft.com/technet/security/bulletin/MS10-041.mspx |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2010-06-09 |