CVE-2013-2153

Related Files

Apache Santuario XML Security For C++ Signature Bypass

Posted Jun 18, 2013

Authored by James Forshaw

The implementation of XML digital signatures in the Santuario-C++ library is vulnerable to a spoofing issue allowing an attacker to reuse existing signatures with arbitrary content. The vulnerability affects only applications that do not perform proper checking/analysis of the content of the Reference elements in the Signature, but the bug exacerbates this problem by opening such applications to attacks using arbitrary content, instead of just attacks involving malicious, but signed, content. Versions prior to 1.7.1 are affected.

tags | advisory, arbitrary, spoof

advisories | CVE-2013-2153

SHA-256 | f4cc52eebffe98291d0852b7719520ff57e20f3844e5293b69e302a109d1c520

Download | Favorite | View

Debian Security Advisory 2710-1

Posted Jun 18, 2013

Authored by Debian | Site debian.org

Debian Linux Security Advisory 2710-1 - James Forshaw from Context Information Security discovered several vulnerabilities in xml-security-c, an implementation of the XML Digital Security specification.

tags | advisory, vulnerability

systems | linux, debian

advisories | CVE-2013-2153, CVE-2013-2154, CVE-2013-2155, CVE-2013-2156

SHA-256 | 9115a6092e44a563c15e997a4b11c3f9292f19c14422c4354bf87e64e409defa

Download | Favorite | View