1. CVE-Search
  2. CVE-2009-0217
ID CVE-2009-0217
Summary The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.
References
Vulnerable Configurations
  • cpe:2.3:a:ibm:websphere_application_server:6.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.5:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.7:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.1.7:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.9:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.1.9:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.11:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.1.11:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.13:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.1.13:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.15:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.1.15:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.1.17:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.1.17:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:fp17:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:fp17:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.10:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.10:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.11:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.11:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.12:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.12:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.13:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.13:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.14:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.14:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.15:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.15:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.16:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.16:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.17:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.17:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.18:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.18:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.19:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.19:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.20:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.20:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.21:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.21:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.22:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.22:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.23:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.23:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.24:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.24:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.25:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.25:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.28:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.28:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.29:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.29:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.30:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.30:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.31:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.31:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.32:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.32:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.0.2.33:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.0.2.33:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.11:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.11:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.12:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.12:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.13:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.13:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.14:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.14:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.15:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.15:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.16:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.16:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.17:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.17:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.18:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.18:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.19:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.19:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.20:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.20:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.21:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.21:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.22:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.22:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:6.1.0.23:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:6.1.0.23:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:websphere_application_server:7.0.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:websphere_application_server:7.0.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mono_project:mono:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:mono_project:mono:1.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mono_project:mono:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:mono_project:mono:1.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mono_project:mono:1.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:mono_project:mono:1.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mono_project:mono:1.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:mono_project:mono:1.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mono_project:mono:1.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:mono_project:mono:1.2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mono_project:mono:1.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:mono_project:mono:1.2.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mono_project:mono:1.9:*:*:*:*:*:*:*
    cpe:2.3:a:mono_project:mono:1.9:*:*:*:*:*:*:*
  • cpe:2.3:a:mono_project:mono:2.0:*:*:*:*:*:*:*
    cpe:2.3:a:mono_project:mono:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:application_server:10.1.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:application_server:10.1.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:application_server:10.1.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:application_server:10.1.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:application_server:10.1.4.3im:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:application_server:10.1.4.3im:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:bea_product_suite:8.1:sp6:*:*:*:*:*:*
    cpe:2.3:a:oracle:bea_product_suite:8.1:sp6:*:*:*:*:*:*
  • cpe:2.3:a:oracle:bea_product_suite:9.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:bea_product_suite:9.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:bea_product_suite:9.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:bea_product_suite:9.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:bea_product_suite:9.2:mp3:*:*:*:*:*:*
    cpe:2.3:a:oracle:bea_product_suite:9.2:mp3:*:*:*:*:*:*
  • cpe:2.3:a:oracle:bea_product_suite:10.0:mp1:*:*:*:*:*:*
    cpe:2.3:a:oracle:bea_product_suite:10.0:mp1:*:*:*:*:*:*
  • cpe:2.3:a:oracle:bea_product_suite:10.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:bea_product_suite:10.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:weblogic_server_component:8.1:sp6:*:*:*:*:*:*
    cpe:2.3:a:oracle:weblogic_server_component:8.1:sp6:*:*:*:*:*:*
  • cpe:2.3:a:oracle:weblogic_server_component:9.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:weblogic_server_component:9.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:weblogic_server_component:9.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:weblogic_server_component:9.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:weblogic_server_component:9.2:mp3:*:*:*:*:*:*
    cpe:2.3:a:oracle:weblogic_server_component:9.2:mp3:*:*:*:*:*:*
  • cpe:2.3:a:oracle:weblogic_server_component:10.0:mp1:*:*:*:*:*:*
    cpe:2.3:a:oracle:weblogic_server_component:10.0:mp1:*:*:*:*:*:*
  • cpe:2.3:a:oracle:weblogic_server_component:10.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:weblogic_server_component:10.3:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 12-10-2018 - 21:49)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:P/A:N
msbulletin via4
bulletin_id MS10-041
bulletin_url
date 2010-06-08T00:00:00
impact Tampering
knowledgebase_id 981343
knowledgebase_url
severity Important
title Vulnerability in Microsoft .NET Framework Could Allow Tampering
oval via4
  • accepted 2013-04-29T04:03:03.908-04:00
    class vulnerability
    contributors
    • name Aharon Chernin
      organization SCAP.com, LLC
    • name Dragos Prisaca
      organization G2, Inc.
    definition_extensions
    • comment The operating system installed on the system is Red Hat Enterprise Linux 4
      oval oval:org.mitre.oval:def:11831
    • comment CentOS Linux 4.x
      oval oval:org.mitre.oval:def:16636
    • comment Oracle Linux 4.x
      oval oval:org.mitre.oval:def:15990
    • comment The operating system installed on the system is Red Hat Enterprise Linux 5
      oval oval:org.mitre.oval:def:11414
    • comment The operating system installed on the system is CentOS Linux 5.x
      oval oval:org.mitre.oval:def:15802
    • comment Oracle Linux 5.x
      oval oval:org.mitre.oval:def:15459
    description and bypass authentication by specifying a truncation length with a small number of bits.
    family unix
    id oval:org.mitre.oval:def:10186
    status accepted
    submitted 2010-07-09T03:56:16-04:00
    title and bypass authentication by specifying a truncation length with a small number of bits.
    version 31
  • accepted 2014-08-18T04:06:24.788-04:00
    class vulnerability
    contributors
    • name Dragos Prisaca
      organization Symantec Corporation
    • name J. Daniel Brown
      organization DTCC
    • name Dragos Prisaca
      organization Symantec Corporation
    • name Sharath S
      organization SecPod Technologies
    • name Maria Mikhno
      organization ALTX-SOFT
    definition_extensions
    • comment Microsoft Windows 2000 is installed
      oval oval:org.mitre.oval:def:85
    • comment Microsoft Windows XP (32-bit) is installed
      oval oval:org.mitre.oval:def:1353
    • comment Microsoft Windows XP x64 is installed
      oval oval:org.mitre.oval:def:15247
    • comment Microsoft Windows Server 2003 (x64) is installed
      oval oval:org.mitre.oval:def:730
    • comment Microsoft Windows Server 2003 (ia64) Gold is installed
      oval oval:org.mitre.oval:def:396
    • comment Microsoft Windows Vista (32-bit) is installed
      oval oval:org.mitre.oval:def:1282
    • comment Microsoft Windows Vista x64 Edition is installed
      oval oval:org.mitre.oval:def:2041
    • comment Microsoft Windows Server 2008 (32-bit) is installed
      oval oval:org.mitre.oval:def:4870
    • comment Microsoft Windows Server 2008 (64-bit) is installed
      oval oval:org.mitre.oval:def:5356
    • comment Microsoft Windows Server 2008 (ia-64) is installed
      oval oval:org.mitre.oval:def:5667
    • comment Microsoft .NET Framework 1.1 Service Pack 1 is Installed
      oval oval:org.mitre.oval:def:1834
    • comment Microsoft Windows Server 2003 (32-bit) is installed
      oval oval:org.mitre.oval:def:1870
    • comment Microsoft .NET Framework 1.1 Service Pack 1 is Installed
      oval oval:org.mitre.oval:def:1834
    • comment Microsoft Windows Vista (32-bit) is installed
      oval oval:org.mitre.oval:def:1282
    • comment Microsoft Windows Vista x64 Edition is installed
      oval oval:org.mitre.oval:def:2041
    • comment Microsoft Windows Server 2008 (32-bit) is installed
      oval oval:org.mitre.oval:def:4870
    • comment Microsoft Windows Server 2008 (64-bit) is installed
      oval oval:org.mitre.oval:def:5356
    • comment Microsoft Windows Server 2008 (ia-64) is installed
      oval oval:org.mitre.oval:def:5667
    • comment Microsoft .NET Framework 3.5 Original Release is installed
      oval oval:org.mitre.oval:def:6689
    • comment Microsoft Windows 2000 is installed
      oval oval:org.mitre.oval:def:85
    • comment Microsoft Windows XP (32-bit) is installed
      oval oval:org.mitre.oval:def:1353
    • comment Microsoft Windows XP x64 is installed
      oval oval:org.mitre.oval:def:15247
    • comment Microsoft Windows Server 2003 (32-bit) is installed
      oval oval:org.mitre.oval:def:1870
    • comment Microsoft Windows Server 2003 (x64) is installed
      oval oval:org.mitre.oval:def:730
    • comment Microsoft Windows Server 2003 (ia64) Gold is installed
      oval oval:org.mitre.oval:def:396
    • comment Microsoft Windows Vista (32-bit) is installed
      oval oval:org.mitre.oval:def:1282
    • comment Microsoft Windows Vista x64 Edition is installed
      oval oval:org.mitre.oval:def:2041
    • comment Microsoft Windows Server 2008 (32-bit) is installed
      oval oval:org.mitre.oval:def:4870
    • comment Microsoft Windows Server 2008 (64-bit) is installed
      oval oval:org.mitre.oval:def:5356
    • comment Microsoft Windows Server 2008 (ia-64) is installed
      oval oval:org.mitre.oval:def:5667
    • comment Microsoft .NET Framework 2.0 Service Pack 2 is installed
      oval oval:org.mitre.oval:def:6158
    • comment Microsoft .NET Framework 3.5 SP1 is installed
      oval oval:org.mitre.oval:def:12542
    • comment Microsoft Windows XP (32-bit) is installed
      oval oval:org.mitre.oval:def:1353
    • comment Microsoft Windows XP x64 is installed
      oval oval:org.mitre.oval:def:15247
    • comment Microsoft Windows Server 2003 (32-bit) is installed
      oval oval:org.mitre.oval:def:1870
    • comment Microsoft Windows Server 2003 (x64) is installed
      oval oval:org.mitre.oval:def:730
    • comment Microsoft Windows Server 2003 (ia64) Gold is installed
      oval oval:org.mitre.oval:def:396
    • comment Microsoft .NET Framework 3.5 Original Release is installed
      oval oval:org.mitre.oval:def:6689
    • comment Microsoft Windows Vista (32-bit) is installed
      oval oval:org.mitre.oval:def:1282
    • comment Microsoft Windows Vista x64 Edition is installed
      oval oval:org.mitre.oval:def:2041
    • comment Microsoft Windows Server 2008 (32-bit) is installed
      oval oval:org.mitre.oval:def:4870
    • comment Microsoft Windows Server 2008 (64-bit) is installed
      oval oval:org.mitre.oval:def:5356
    • comment Microsoft Windows Server 2008 (ia-64) is installed
      oval oval:org.mitre.oval:def:5667
    • comment Microsoft .NET Framework 3.5 SP1 is installed
      oval oval:org.mitre.oval:def:12542
    • comment Microsoft Windows 7 (32-bit) is installed
      oval oval:org.mitre.oval:def:6165
    • comment Microsoft Windows 7 x64 Edition is installed
      oval oval:org.mitre.oval:def:5950
    • comment Microsoft Windows Server 2008 R2 x64 Edition is installed
      oval oval:org.mitre.oval:def:6438
    • comment Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed
      oval oval:org.mitre.oval:def:5954
    • comment Microsoft .NET Framework 3.5 SP1 is installed
      oval oval:org.mitre.oval:def:12542
    description The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.
    family windows
    id oval:org.mitre.oval:def:7158
    status accepted
    submitted 2010-06-08T13:00:00
    title XML Signature HMAC Truncation Authentication Bypass Vulnerability
    version 49
  • accepted 2015-04-20T04:02:41.445-04:00
    class vulnerability
    contributors
    • name Pai Peng
      organization Hewlett-Packard
    • name Sushant Kumar Singh
      organization Hewlett-Packard
    • name Sushant Kumar Singh
      organization Hewlett-Packard
    • name Prashant Kumar
      organization Hewlett-Packard
    • name Mike Cokus
      organization The MITRE Corporation
    description The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.
    family unix
    id oval:org.mitre.oval:def:8717
    status accepted
    submitted 2010-03-22T17:00:25.000-04:00
    title HP-UX Running Java, Remote Increase in Privilege, Denial of Service and Other Vulnerabilities
    version 47
redhat via4
advisories
  • bugzilla
    id 511915
    title CVE-2009-0217 xmlsec1, mono, xml-security-c, xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 4 is installed
        oval oval:com.redhat.rhba:tst:20070304025
      • OR
        • AND
          • comment xmlsec1 is earlier than 0:1.2.6-3.1
            oval oval:com.redhat.rhsa:tst:20091428001
          • comment xmlsec1 is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20091428002
        • AND
          • comment xmlsec1-devel is earlier than 0:1.2.6-3.1
            oval oval:com.redhat.rhsa:tst:20091428003
          • comment xmlsec1-devel is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20091428004
        • AND
          • comment xmlsec1-openssl is earlier than 0:1.2.6-3.1
            oval oval:com.redhat.rhsa:tst:20091428005
          • comment xmlsec1-openssl is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20091428006
        • AND
          • comment xmlsec1-openssl-devel is earlier than 0:1.2.6-3.1
            oval oval:com.redhat.rhsa:tst:20091428007
          • comment xmlsec1-openssl-devel is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20091428008
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhba:tst:20070331005
      • OR
        • AND
          • comment xmlsec1 is earlier than 0:1.2.9-8.1.1
            oval oval:com.redhat.rhsa:tst:20091428010
          • comment xmlsec1 is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20091428011
        • AND
          • comment xmlsec1-devel is earlier than 0:1.2.9-8.1.1
            oval oval:com.redhat.rhsa:tst:20091428012
          • comment xmlsec1-devel is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20091428013
        • AND
          • comment xmlsec1-gnutls is earlier than 0:1.2.9-8.1.1
            oval oval:com.redhat.rhsa:tst:20091428014
          • comment xmlsec1-gnutls is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20091428015
        • AND
          • comment xmlsec1-gnutls-devel is earlier than 0:1.2.9-8.1.1
            oval oval:com.redhat.rhsa:tst:20091428016
          • comment xmlsec1-gnutls-devel is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20091428017
        • AND
          • comment xmlsec1-nss is earlier than 0:1.2.9-8.1.1
            oval oval:com.redhat.rhsa:tst:20091428018
          • comment xmlsec1-nss is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20091428019
        • AND
          • comment xmlsec1-nss-devel is earlier than 0:1.2.9-8.1.1
            oval oval:com.redhat.rhsa:tst:20091428020
          • comment xmlsec1-nss-devel is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20091428021
        • AND
          • comment xmlsec1-openssl is earlier than 0:1.2.9-8.1.1
            oval oval:com.redhat.rhsa:tst:20091428022
          • comment xmlsec1-openssl is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20091428023
        • AND
          • comment xmlsec1-openssl-devel is earlier than 0:1.2.9-8.1.1
            oval oval:com.redhat.rhsa:tst:20091428024
          • comment xmlsec1-openssl-devel is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20091428025
    rhsa
    id RHSA-2009:1428
    released 2009-09-08
    severity Moderate
    title RHSA-2009:1428: xmlsec1 security update (Moderate)
  • rhsa
    id RHSA-2009:1200
  • rhsa
    id RHSA-2009:1201
  • rhsa
    id RHSA-2009:1636
  • rhsa
    id RHSA-2009:1637
  • rhsa
    id RHSA-2009:1649
  • rhsa
    id RHSA-2009:1650
  • rhsa
    id RHSA-2009:1694
rpms
  • java-1.6.0-sun-1:1.6.0.15-1jpp.1.el4
  • java-1.6.0-sun-1:1.6.0.15-1jpp.1.el5
  • java-1.6.0-sun-demo-1:1.6.0.15-1jpp.1.el4
  • java-1.6.0-sun-demo-1:1.6.0.15-1jpp.1.el5
  • java-1.6.0-sun-devel-1:1.6.0.15-1jpp.1.el4
  • java-1.6.0-sun-devel-1:1.6.0.15-1jpp.1.el5
  • java-1.6.0-sun-jdbc-1:1.6.0.15-1jpp.1.el4
  • java-1.6.0-sun-jdbc-1:1.6.0.15-1jpp.1.el5
  • java-1.6.0-sun-plugin-1:1.6.0.15-1jpp.1.el4
  • java-1.6.0-sun-plugin-1:1.6.0.15-1jpp.1.el5
  • java-1.6.0-sun-src-1:1.6.0.15-1jpp.1.el4
  • java-1.6.0-sun-src-1:1.6.0.15-1jpp.1.el5
  • java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5
  • java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.2.b09.el5
  • java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5
  • java-1.6.0-openjdk-devel-1:1.6.0.0-1.2.b09.el5
  • java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.2.b09.el5
  • java-1.6.0-openjdk-src-1:1.6.0.0-1.2.b09.el5
  • xmlsec1-0:1.2.6-3.1
  • xmlsec1-0:1.2.9-8.1.1
  • xmlsec1-debuginfo-0:1.2.6-3.1
  • xmlsec1-debuginfo-0:1.2.9-8.1.1
  • xmlsec1-devel-0:1.2.6-3.1
  • xmlsec1-devel-0:1.2.9-8.1.1
  • xmlsec1-gnutls-0:1.2.9-8.1.1
  • xmlsec1-gnutls-devel-0:1.2.9-8.1.1
  • xmlsec1-nss-0:1.2.9-8.1.1
  • xmlsec1-nss-devel-0:1.2.9-8.1.1
  • xmlsec1-openssl-0:1.2.6-3.1
  • xmlsec1-openssl-0:1.2.9-8.1.1
  • xmlsec1-openssl-devel-0:1.2.6-3.1
  • xmlsec1-openssl-devel-0:1.2.9-8.1.1
  • glassfish-javamail-0:1.4.2-0jpp.ep1.5.el4
  • glassfish-jaxb-0:2.1.4-1.12.patch03.ep1.el4
  • glassfish-jaxb-javadoc-0:2.1.4-1.12.patch03.ep1.el4
  • glassfish-jsf-0:1.2_13-2.1.ep1.el4
  • hibernate3-1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4
  • hibernate3-annotations-0:3.3.1-1.11.GA_CP02.ep1.el4
  • hibernate3-annotations-javadoc-0:3.3.1-1.11.GA_CP02.ep1.el4
  • hibernate3-entitymanager-0:3.3.2-2.5.GA_CP01.ep1.el4
  • hibernate3-entitymanager-javadoc-0:3.3.2-2.5.GA_CP01.ep1.el4
  • hibernate3-javadoc-1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4
  • jacorb-0:2.3.0-1jpp.ep1.9.el4
  • jakarta-commons-logging-jboss-0:1.1-9.ep1.el4
  • jboss-aop-0:1.5.5-3.CP04.2.ep1.el4
  • jboss-common-0:1.2.1-0jpp.ep1.3.el4
  • jboss-messaging-0:1.4.0-3.SP3_CP09.4.ep1.el4
  • jboss-remoting-0:2.2.3-3.SP1.ep1.el4
  • jboss-seam-0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.18.el4
  • jboss-seam-docs-0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.18.el4
  • jboss-seam2-0:2.0.2.FP-1.ep1.21.el4
  • jboss-seam2-docs-0:2.0.2.FP-1.ep1.21.el4
  • jbossas-0:4.3.0-6.GA_CP07.4.ep1.el4
  • jbossas-4.3.0.GA_CP07-bin-0:4.3.0-6.GA_CP07.4.ep1.el4
  • jbossas-client-0:4.3.0-6.GA_CP07.4.ep1.el4
  • jbossts-1:4.2.3-1.SP5_CP08.1jpp.ep1.1.el4
  • jbossweb-0:2.0.0-6.CP12.0jpp.ep1.2.el4
  • jbossws-0:2.0.1-4.SP2_CP07.2.ep1.el4
  • jbossws-common-0:1.0.0-2.GA_CP05.1.ep1.el4
  • jbossws-framework-0:2.0.1-1.GA_CP05.1.ep1.el4
  • jbossws-native42-0:2.0.1-4.SP2_CP07.2.ep1.el4
  • jcommon-0:1.0.16-1.1.ep1.el4
  • jfreechart-0:1.0.13-2.3.1.ep1.el4
  • jgroups-1:2.4.7-1.ep1.el4
  • quartz-0:1.5.2-1jpp.patch01.ep1.4.el4
  • rh-eap-docs-0:4.3.0-6.GA_CP07.ep1.3.el4
  • rh-eap-docs-examples-0:4.3.0-6.GA_CP07.ep1.3.el4
  • xerces-j2-0:2.7.1-9jpp.4.patch_02.1.ep1.el4
  • xml-security-0:1.3.0-1.3.patch01.ep1.2.el4
  • glassfish-javamail-0:1.4.2-0jpp.ep1.5.el4
  • glassfish-jsf-0:1.2_13-2.1.ep1.el4
  • hibernate3-1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4
  • hibernate3-annotations-0:3.3.1-1.11.GA_CP02.ep1.el4
  • hibernate3-annotations-javadoc-0:3.3.1-1.11.GA_CP02.ep1.el4
  • hibernate3-entitymanager-0:3.3.2-2.5.GA_CP01.ep1.el4
  • hibernate3-entitymanager-javadoc-0:3.3.2-2.5.GA_CP01.ep1.el4
  • hibernate3-javadoc-1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4
  • jacorb-0:2.3.0-1jpp.ep1.9.el4
  • jakarta-commons-logging-jboss-0:1.1-9.ep1.el4
  • jboss-aop-0:1.5.5-3.CP04.2.ep1.el4
  • jboss-common-0:1.2.1-0jpp.ep1.3.el4
  • jboss-remoting-0:2.2.3-3.SP1.ep1.el4
  • jboss-seam-0:1.2.1-1.ep1.22.el4
  • jboss-seam-docs-0:1.2.1-1.ep1.22.el4
  • jbossas-0:4.2.0-5.GA_CP08.5.ep1.el4
  • jbossas-4.2.0.GA_CP08-bin-0:4.2.0-5.GA_CP08.5.ep1.el4
  • jbossas-client-0:4.2.0-5.GA_CP08.5.ep1.el4
  • jbossts-1:4.2.3-1.SP5_CP08.1jpp.ep1.1.el4
  • jbossweb-0:2.0.0-6.CP12.0jpp.ep1.2.el4
  • jcommon-0:1.0.16-1.1.ep1.el4
  • jfreechart-0:1.0.13-2.3.1.ep1.el4
  • jgroups-1:2.4.7-1.ep1.el4
  • quartz-0:1.5.2-1jpp.patch01.ep1.4.el4
  • rh-eap-docs-0:4.2.0-6.GA_CP08.ep1.3.el4
  • rh-eap-docs-examples-0:4.2.0-6.GA_CP08.ep1.3.el4
  • xerces-j2-0:2.7.1-9jpp.4.patch_02.1.ep1.el4
  • xml-security-0:1.3.0-1.3.patch01.ep1.2.el4
  • glassfish-jaxb-0:2.1.4-1.12.patch03.1.ep1.el5
  • glassfish-jaxb-javadoc-0:2.1.4-1.12.patch03.1.ep1.el5
  • glassfish-jsf-0:1.2_13-2.1.ep1.el5
  • hibernate3-1:3.2.4-1.SP1_CP09.0jpp.ep1.2.4.el5
  • hibernate3-annotations-0:3.3.1-1.11GA_CP02.ep1.el5
  • hibernate3-annotations-javadoc-0:3.3.1-1.11GA_CP02.ep1.el5
  • hibernate3-entitymanager-0:3.3.2-2.5.1.ep1.el5
  • hibernate3-entitymanager-javadoc-0:3.3.2-2.5.1.ep1.el5
  • hibernate3-javadoc-1:3.2.4-1.SP1_CP09.0jpp.ep1.2.4.el5
  • jacorb-0:2.3.0-1jpp.ep1.9.1.el5
  • jboss-aop-0:1.5.5-3.CP04.2.ep1.el5
  • jboss-common-0:1.2.1-0jpp.ep1.3.el5.1
  • jboss-messaging-0:1.4.0-3.SP3_CP09.4.ep1.el5
  • jboss-remoting-0:2.2.3-3.SP1.ep1.el5
  • jboss-seam-0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.12.el5.1
  • jboss-seam-docs-0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.12.el5.1
  • jboss-seam2-0:2.0.2.FP-1.ep1.18.el5
  • jboss-seam2-docs-0:2.0.2.FP-1.ep1.18.el5
  • jbossas-0:4.3.0-6.GA_CP07.4.2.ep1.el5
  • jbossas-4.3.0.GA_CP07-bin-0:4.3.0-6.GA_CP07.4.2.ep1.el5
  • jbossas-client-0:4.3.0-6.GA_CP07.4.2.ep1.el5
  • jbossts-1:4.2.3-1.SP5_CP08.1jpp.ep1.1.el5
  • jbossweb-0:2.0.0-6.CP12.0jpp.ep1.2.el5
  • jbossws-0:2.0.1-4.SP2_CP07.2.1.ep1.el5
  • jbossws-common-0:1.0.0-2.GA_CP05.1.ep1.el5
  • jbossws-framework-0:2.0.1-1.GA_CP05.1.ep1.el5
  • jbossws-native42-0:2.0.1-4.SP2_CP07.2.1.ep1.el5
  • jcommon-0:1.0.16-1.1.ep1.el5
  • jfreechart-0:1.0.13-2.3.1.ep1.el5
  • jgroups-1:2.4.7-1.ep1.el5
  • quartz-0:1.5.2-1jpp.patch01.ep1.4.1.el5
  • rh-eap-docs-0:4.3.0-6.GA_CP07.ep1.3.el5
  • rh-eap-docs-examples-0:4.3.0-6.GA_CP07.ep1.3.el5
  • xml-security-0:1.3.0-1.3.patch01.ep1.2.1.el5
  • glassfish-jsf-0:1.2_13-2.1.ep1.el5
  • hibernate3-1:3.2.4-1.SP1_CP09.0jpp.ep1.2.4.el5
  • hibernate3-annotations-0:3.3.1-1.11GA_CP02.ep1.el5
  • hibernate3-annotations-javadoc-0:3.3.1-1.11GA_CP02.ep1.el5
  • hibernate3-entitymanager-0:3.3.2-2.5.1.ep1.el5
  • hibernate3-entitymanager-javadoc-0:3.3.2-2.5.1.ep1.el5
  • hibernate3-javadoc-1:3.2.4-1.SP1_CP09.0jpp.ep1.2.4.el5
  • jacorb-0:2.3.0-1jpp.ep1.9.1.el5
  • jboss-aop-0:1.5.5-3.CP04.2.ep1.el5
  • jboss-common-0:1.2.1-0jpp.ep1.3.el5.1
  • jboss-remoting-0:2.2.3-3.SP1.ep1.el5
  • jboss-seam-0:1.2.1-1.ep1.14.el5
  • jboss-seam-docs-0:1.2.1-1.ep1.14.el5
  • jbossas-0:4.2.0-5.GA_CP08.5.2.ep1.el5
  • jbossas-4.2.0.GA_CP08-bin-0:4.2.0-5.GA_CP08.5.2.ep1.el5
  • jbossas-client-0:4.2.0-5.GA_CP08.5.2.ep1.el5
  • jbossts-1:4.2.3-1.SP5_CP08.1jpp.ep1.1.el5
  • jbossweb-0:2.0.0-6.CP12.0jpp.ep1.2.el5
  • jcommon-0:1.0.16-1.1.ep1.el5
  • jfreechart-0:1.0.13-2.3.1.ep1.el5
  • jgroups-1:2.4.7-1.ep1.el5
  • quartz-0:1.5.2-1jpp.patch01.ep1.4.1.el5
  • rh-eap-docs-0:4.2.0-6.GA_CP08.ep1.3.el5
  • rh-eap-docs-examples-0:4.2.0-6.GA_CP08.ep1.3.el5
  • xml-security-0:1.3.0-1.3.patch01.ep1.2.1.el5
  • java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5
  • java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4
  • java-1.6.0-ibm-accessibility-1:1.6.0.7-1jpp.2.el5
  • java-1.6.0-ibm-demo-1:1.6.0.7-1jpp.2.el5
  • java-1.6.0-ibm-demo-1:1.6.0.7-1jpp.3.el4
  • java-1.6.0-ibm-devel-1:1.6.0.7-1jpp.2.el5
  • java-1.6.0-ibm-devel-1:1.6.0.7-1jpp.3.el4
  • java-1.6.0-ibm-javacomm-1:1.6.0.7-1jpp.2.el5
  • java-1.6.0-ibm-javacomm-1:1.6.0.7-1jpp.3.el4
  • java-1.6.0-ibm-jdbc-1:1.6.0.7-1jpp.2.el5
  • java-1.6.0-ibm-jdbc-1:1.6.0.7-1jpp.3.el4
  • java-1.6.0-ibm-plugin-1:1.6.0.7-1jpp.2.el5
  • java-1.6.0-ibm-plugin-1:1.6.0.7-1jpp.3.el4
  • java-1.6.0-ibm-src-1:1.6.0.7-1jpp.2.el5
  • java-1.6.0-ibm-src-1:1.6.0.7-1jpp.3.el4
  • java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5
  • java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4
  • java-1.6.0-ibm-devel-1:1.6.0.7-1jpp.2.el5
  • java-1.6.0-ibm-devel-1:1.6.0.7-1jpp.3.el4
refmap via4
aixapar
  • PK80596
  • PK80627
apple APPLE-SA-2009-09-03-1
bid 35671
cert
  • TA09-294A
  • TA10-159B
cert-vn VU#466161
confirm
debian DSA-1995
fedora
  • FEDORA-2009-8329
  • FEDORA-2009-8337
  • FEDORA-2009-8456
  • FEDORA-2009-8473
gentoo GLSA-201408-19
hp
  • HPSBUX02476
  • SSRT090250
mandriva MDVSA-2009:209
misc http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html
osvdb
  • 55895
  • 55907
sectrack
  • 1022561
  • 1022567
  • 1022661
secunia
  • 34461
  • 35776
  • 35852
  • 35853
  • 35854
  • 35855
  • 35858
  • 36162
  • 36176
  • 36180
  • 36494
  • 37300
  • 37671
  • 37841
  • 38567
  • 38568
  • 38695
  • 38921
  • 41818
  • 60799
sunalert
  • 1020710
  • 263429
  • 269208
suse
  • SUSE-SA:2009:053
  • SUSE-SA:2010:017
ubuntu
  • USN-826-1
  • USN-903-1
vupen
  • ADV-2009-1900
  • ADV-2009-1908
  • ADV-2009-1909
  • ADV-2009-1911
  • ADV-2009-2543
  • ADV-2009-3122
  • ADV-2010-0366
  • ADV-2010-0635
Last major update 12-10-2018 - 21:49
Published 14-07-2009 - 23:30
Last modified 12-10-2018 - 21:49
Back to Top