[AXIS2C-1607] CVE-2012-5351 - "Signature exclusion attack," a different vulnerability than CVE-2012-4418

• Type: Bug
• Status: Open
• Priority: Critical
• Resolution: Unresolved
• Fix Version/s: 1.7.0
• Assignee: Unassigned
• Reporter: Brian Thomason
• Created: 26/Oct/12 19:13
• Updated: 07/Apr/20 19:36

Description

Common Vulnerabilities and Exposures assigned an identifier CVE-2012-5351 to
the following vulnerability:

Name: CVE-2012-5351
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5351
Assigned: 20121009
Reference: http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf

Apache Axis2 allows remote attackers to forge messages and bypass
authentication via a SAML assertion that lacks a Signature element,
aka a "Signature exclusion attack," a different vulnerability than
CVE-2012-4418.

Issue Links

• blocks: AXIS2C-1681 Apache Axis2C Roadmap 1.7 Planning
• is cloned by: AXIS2C-1694 CVE-2012-4418 - "XML Signature wrapping attack"
• is related to: AXIS2C-1694 CVE-2012-4418 - "XML Signature wrapping attack"