Apache Axis2 Vulnerable to XML Signature wrapping attack

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2012-4418 · ADVISORY
• bugzilla.redhat.com/show_bug.cgi · WEB
• apache/axis-axis2-java-core · PACKAGE
• issues.apache.org/jira/browse/AXIS2-5930 · WEB
• issues.apache.org/jira/browse/AXIS2C-1694 · WEB
• web.archive.org/web/20121114075457/http://www.securityfocus.com/bid/55508 · WEB
• nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf · WEB
• openwall.com/lists/oss-security/2012/09/12/1 · WEB
• openwall.com/lists/oss-security/2012/09/13/1 · WEB
• securityfocus.com/bid/55508

org.apache.axis2:axis2 のその他の脆弱性

• CVE-2012-5785中 5.8Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subj…
• CVE-2012-5351中 6.4Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a …