NVD

Id
47552  
Name
CVE-2009-0217  
Description
The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2009-07-14  
Modified Date
2014-11-13  
Seq
2009-0217  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
238214 47552 CVE-2009-0217 http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161  View
238215 47552 CVE-2009-0217 http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7  View
238216 47552 CVE-2009-0217 http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7  View
238217 47552 CVE-2009-0217 APPLE-SA-2009-09-03-1  View
238218 47552 CVE-2009-0217 SUSE-SA:2009:053  View
238219 47552 CVE-2009-0217 SUSE-SA:2010:017  View
238220 47552 CVE-2009-0217 SSRT090250  View
238221 47552 CVE-2009-0217 oval:org.mitre.oval:def:10186  View
238222 47552 CVE-2009-0217 oval:org.mitre.oval:def:7158  View
238223 47552 CVE-2009-0217 oval:org.mitre.oval:def:8717  View
238224 47552 CVE-2009-0217 http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1  View
238225 47552 CVE-2009-0217 263429  View
238226 47552 CVE-2009-0217 269208  View
238227 47552 CVE-2009-0217 1020710  View
238228 47552 CVE-2009-0217 http://svn.apache.org/viewvc?revision=794013&view=revision  View
238229 47552 CVE-2009-0217 PK80596  View
238230 47552 CVE-2009-0217 PK80627  View
238231 47552 CVE-2009-0217 http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg21384925  View
238232 47552 CVE-2009-0217 http://www.aleksey.com/xmlsec/  View
238233 47552 CVE-2009-0217 DSA-1995  View
238234 47552 CVE-2009-0217 GLSA-201408-19  View
238235 47552 CVE-2009-0217 VU#466161  View
238236 47552 CVE-2009-0217 http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ  View
238237 47552 CVE-2009-0217 http://www.kb.cert.org/vuls/id/WDON-7TY529  View
238238 47552 CVE-2009-0217 MDVSA-2009:209  View
238239 47552 CVE-2009-0217 MS10-041  View
238240 47552 CVE-2009-0217 http://www.mono-project.com/Vulnerabilities  View
238241 47552 CVE-2009-0217 http://www.openoffice.org/security/cves/CVE-2009-0217.html  View
238242 47552 CVE-2009-0217 http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html  View
238243 47552 CVE-2009-0217 http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html  View
238244 47552 CVE-2009-0217 http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html  View
238245 47552 CVE-2009-0217 RHSA-2009:1694  View
238246 47552 CVE-2009-0217 35671  View
238247 47552 CVE-2009-0217 1022561  View
238248 47552 CVE-2009-0217 1022567  View
238249 47552 CVE-2009-0217 1022661  View
238250 47552 CVE-2009-0217 USN-903-1  View
238251 47552 CVE-2009-0217 USN-826-1  View
238252 47552 CVE-2009-0217 TA09-294A  View
238253 47552 CVE-2009-0217 TA10-159B  View
238254 47552 CVE-2009-0217 ADV-2009-1900  View
238255 47552 CVE-2009-0217 ADV-2009-1908  View
238256 47552 CVE-2009-0217 ADV-2009-1909  View
238257 47552 CVE-2009-0217 ADV-2009-1911  View
238258 47552 CVE-2009-0217 ADV-2009-2543  View
238259 47552 CVE-2009-0217 ADV-2009-3122  View
238260 47552 CVE-2009-0217 ADV-2010-0366  View
238261 47552 CVE-2009-0217 ADV-2010-0635  View
238262 47552 CVE-2009-0217 http://www.w3.org/2008/06/xmldsigcore-errata.html#e03  View
238263 47552 CVE-2009-0217 http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html  View
238264 47552 CVE-2009-0217 https://bugzilla.redhat.com/show_bug.cgi?id=511915  View
238265 47552 CVE-2009-0217 https://issues.apache.org/bugzilla/show_bug.cgi?id=47526  View
238266 47552 CVE-2009-0217 https://issues.apache.org/bugzilla/show_bug.cgi?id=47527  View
238267 47552 CVE-2009-0217 RHSA-2009:1200  View
238268 47552 CVE-2009-0217 RHSA-2009:1201  View
238269 47552 CVE-2009-0217 RHSA-2009:1428  View
238270 47552 CVE-2009-0217 RHSA-2009:1636  View
238271 47552 CVE-2009-0217 RHSA-2009:1637  View
238272 47552 CVE-2009-0217 RHSA-2009:1649  View
238273 47552 CVE-2009-0217 RHSA-2009:1650  View
238274 47552 CVE-2009-0217 FEDORA-2009-8329  View
238275 47552 CVE-2009-0217 FEDORA-2009-8337  View
238276 47552 CVE-2009-0217 FEDORA-2009-8456  View
238277 47552 CVE-2009-0217 FEDORA-2009-8473  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40905 JVNDB-2009-001911 XML 署名の検証において認証回避が可能な問題 XML 署名 (XMLDsig) で規定されている HMAC truncation に起因する認証回避が可能な問題が存在します。 CVE-2009-0217 37648 CVE-2009-0217 47552 5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001911.html 2009-07-15 2010-07-22 View