CVE-2009-0217

Description

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.

5.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 34.98% Top 5%

Vendor Advisory redhat.com Vendor Advisory gentoo.org Vendor Advisory ibm.com Vendor Advisory redhat.com Vendor Advisory sun.com Vendor Advisory debian.org Vendor Advisory marc.info Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory sun.com Vendor Advisory ubuntu.com Vendor Advisory mandriva.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory sun.com Vendor Advisory redhat.com Vendor Advisory ibm.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory ubuntu.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory apple.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory microsoft.com Vendor Advisory redhat.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory ibm.com Vendor Advisory mono-project.com Vendor Advisory vupen.com Vendor Advisory vupen.com Vendor Advisory vupen.com Vendor Advisory vupen.com Vendor Advisory w3.org Vendor Advisory w3.org

Affected: n/a n/a

References

Link	Tags
https://rhn.redhat.com/errata/RHSA-2009-1428.html	vendor advisory
http://www.vupen.com/english/advisories/2009/3122	vdb entry
http://www.openoffice.org/security/cves/CVE-2009-0217.html
https://issues.apache.org/bugzilla/show_bug.cgi?id=47526
http://secunia.com/advisories/60799	third party advisory
http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml	vendor advisory
http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023545&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphere	patch vendor advisory
https://rhn.redhat.com/errata/RHSA-2009-1200.html	vendor advisory
http://secunia.com/advisories/35776	third party advisory vendor advisory
http://secunia.com/advisories/36162	third party advisory vendor advisory
http://secunia.com/advisories/36494	third party advisory vendor advisory
http://www.vupen.com/english/advisories/2009/2543	vdb entry
http://secunia.com/advisories/35858	third party advisory vendor advisory
http://secunia.com/advisories/38695	third party advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1	vendor advisory
http://www.debian.org/security/2010/dsa-1995	vendor advisory
http://marc.info/?l=bugtraq&m=125787273209737&w=2	vendor advisory
http://secunia.com/advisories/35853	third party advisory vendor advisory
https://rhn.redhat.com/errata/RHSA-2009-1637.html	vendor advisory
http://www.redhat.com/support/errata/RHSA-2009-1694.html	vendor advisory
http://secunia.com/advisories/35852	third party advisory vendor advisory
http://secunia.com/advisories/35854	third party advisory vendor advisory
http://secunia.com/advisories/34461	third party advisory
http://www.kb.cert.org/vuls/id/WDON-7TY529
http://www.mono-project.com/Vulnerabilities	vendor advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1	vendor advisory
http://www.ubuntu.com/usn/USN-903-1	vendor advisory
http://www.securityfocus.com/bid/35671	patch vdb entry
https://issues.apache.org/bugzilla/show_bug.cgi?id=47527
http://www.vupen.com/english/advisories/2010/0366	vdb entry
http://osvdb.org/55907	vdb entry
http://www.mandriva.com/security/advisories?name=MDVSA-2009:209	vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html	vendor advisory
http://secunia.com/advisories/38567	third party advisory
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html	vendor advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1	vendor advisory
http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161
http://www.vupen.com/english/advisories/2009/1900	patch vendor advisory vdb entry
http://www.securitytracker.com/id?1022561	vdb entry
http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
http://secunia.com/advisories/37671	third party advisory
http://www.kb.cert.org/vuls/id/466161	third party advisory us government resource
http://www.securitytracker.com/id?1022567	vdb entry
https://rhn.redhat.com/errata/RHSA-2009-1636.html	vendor advisory
http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023723&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphere	patch vendor advisory
https://rhn.redhat.com/errata/RHSA-2009-1649.html	vendor advisory
http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
http://www.us-cert.gov/cas/techalerts/TA09-294A.html	third party advisory us government resource
http://www.vupen.com/english/advisories/2009/1909	patch vendor advisory vdb entry
http://www.vupen.com/english/advisories/2010/0635	vdb entry
http://svn.apache.org/viewvc?revision=794013&view=revision
http://secunia.com/advisories/38568	third party advisory
http://secunia.com/advisories/36180	third party advisory vendor advisory
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html	vendor advisory
http://www.w3.org/2008/06/xmldsigcore-errata.html#e03	vendor advisory
https://usn.ubuntu.com/826-1/	vendor advisory
http://secunia.com/advisories/37841	third party advisory
http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html
http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1
http://secunia.com/advisories/35855	third party advisory vendor advisory
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html	vendor advisory
http://secunia.com/advisories/36176	third party advisory vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158	signature vdb entry
http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html	vendor advisory
http://www.vupen.com/english/advisories/2009/1908	patch vendor advisory vdb entry
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html	vendor advisory
http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7
http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg21384925	patch vendor advisory
http://secunia.com/advisories/41818	third party advisory
http://www.securitytracker.com/id?1022661	vdb entry
http://secunia.com/advisories/37300	third party advisory
http://www.vupen.com/english/advisories/2009/1911	patch vendor advisory vdb entry
http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html	vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html	vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717	signature vdb entry
https://rhn.redhat.com/errata/RHSA-2009-1201.html	vendor advisory
http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7
http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ
http://www.us-cert.gov/cas/techalerts/TA10-159B.html	third party advisory us government resource
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186	signature vdb entry
http://osvdb.org/55895	vdb entry
http://www.aleksey.com/xmlsec/
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041	vendor advisory
http://secunia.com/advisories/38921	third party advisory
https://rhn.redhat.com/errata/RHSA-2009-1650.html	vendor advisory
https://bugzilla.redhat.com/show_bug.cgi?id=511915

Frequently Asked Questions

What is the severity of CVE-2009-0217?: CVE-2009-0217 has been scored as a medium severity vulnerability.
How to fix CVE-2009-0217?: To fix CVE-2009-0217, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2009-0217 being actively exploited in the wild?: It is possible that CVE-2009-0217 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~35% probability that this vulnerability will be exploited by malicious actors in the next 30 days.