Bug 47527

Summary:	XML signature HMAC truncation authentication bypass
Product:	Security - Now in JIRA	Reporter:	Scott Cantor <cantor.2>
Component:	C++ Signature	Assignee:	XML Security Developers Mailing List <security-dev>
Status:	CLOSED FIXED
Severity:	blocker
Priority:	P1
Version:	C++ 1.5.0
Target Milestone:	---
Hardware:	All
OS:	All
URL:	http://www.kb.cert.org/vuls/id/466161

Description Scott Cantor 2009-07-14 11:59:37 UTC

Apache XML Security (C++) is affected by the vulnerability published in US-Cert VU #466161. See: http://www.kb.cert.org/vuls/id/466161 for more information. This bug can allow an attacker to bypass authentication by inserting/modifying a small HMAC truncation length parameter in the XML Signature HMAC based SignatureMethod algorithms.

Comment 1 Scott Cantor 2009-07-14 12:04:35 UTC

Fix in svn, will be released in 1.5.1.