Apache Santuario Buffer Overflow Lets Remote Users Deny Service
SecurityTracker Alert ID: 1025755|
SecurityTracker URL: http://securitytracker.com/id/1025755
(Links to External Site)
Date: Jul 8 2011
Denial of service via network|
Fix Available: Yes Vendor Confirmed: Yes |
Version(s): prior to 1.6.1|
A vulnerability was reported in Apache Santuario. A remote user can cause denial of service conditions.|
A remote user can create a specially crafted key that, when used by the target user or application to sign or verify XML signatures, will trigger a buffer overflow and crash.
Paulo Zanoni reported this vulnerability.
A remote user can cause the target application to crash.|
The vendor has issued a fix (1.6.1).|
The vendor's advisory is available at:
Vendor URL: santuario.apache.org/secadv/CVE-2011-2516.txt (Links to External Site)
|Underlying OS: Linux (Any), UNIX (Any), Windows (Any)|
Source Message Contents
Subject: Security Advisory: CVE-2011-2516|
Please be advised that a security issue affecting the Apache XML Security
Library for C++ has been identified and an updated version released to
address the issue. The full text of the advisory is below, and a signed
version can be found at:
-- Scott Cantor
CVE-2011-2516: Apache Santuario XML Security for C++ contains buffer
overflows signing or verifying with large keys.
Vendor: The Apache Software Foundation
Versions Affected: Apache Santuario XML Security for C++ library versions
prior to V1.6.1
Description: A buffer overflow exists when creating or verifying XML
with RSA keys of sizes on the order of 8192 or more bits. This typically
in a crash and denial of service in applications that verify signatures
keys that could be supplied by an attacker.
Mitigation: Applications using library versions older than V1.6.1 should
as soon as possible. Distributors of older versions should apply the
from this subversion revision:
Applications that can prevent the use of arbitrary keys supplied by an
(such as within the ds:KeyInfo element of a signature), or limit key
prevent the exploitation of this bug.
Credit: This issue was reported by Paulo Zanoni.