Strix
26.1K

CVE-2009-0217

UnknownEPSS 6.35%

Last modified

CVE-2009-0217 is a vulnerability of currently unknown severity. The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.. EPSS estimates a 6.35% chance of exploitation in the next 30 days.

Description

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.

Metrics

EPSS Probability
6.35%

92.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersionsUpdate
IbmWebsphere Application Server6.0—
IbmWebsphere Application Server6.0.0.1—
IbmWebsphere Application Server6.0.0.2—
IbmWebsphere Application Server6.0.0.3—
IbmWebsphere Application Server6.0.1—
IbmWebsphere Application Server6.0.1.1—
IbmWebsphere Application Server6.0.1.2—
IbmWebsphere Application Server6.0.1.3—
IbmWebsphere Application Server6.0.1.5—
IbmWebsphere Application Server6.0.1.7—
IbmWebsphere Application Server6.0.1.9—
IbmWebsphere Application Server6.0.1.11—
IbmWebsphere Application Server6.0.1.13—
IbmWebsphere Application Server6.0.1.15—
IbmWebsphere Application Server6.0.1.17—
IbmWebsphere Application Server6.0.2—
IbmWebsphere Application Server6.0.2.1—
IbmWebsphere Application Server6.0.2.2—
IbmWebsphere Application Server6.0.2.3—
IbmWebsphere Application Server6.0.2.10—
IbmWebsphere Application Server6.0.2.11—
IbmWebsphere Application Server6.0.2.12—
IbmWebsphere Application Server6.0.2.13—
IbmWebsphere Application Server6.0.2.14—
IbmWebsphere Application Server6.0.2.15—
IbmWebsphere Application Server6.0.2.16—
IbmWebsphere Application Server6.0.2.17—
IbmWebsphere Application Server6.0.2.18—
IbmWebsphere Application Server6.0.2.19—
IbmWebsphere Application Server6.0.2.20—
IbmWebsphere Application Server6.0.2.21—
IbmWebsphere Application Server6.0.2.22—
IbmWebsphere Application Server6.0.2.23—
IbmWebsphere Application Server6.0.2.24—
IbmWebsphere Application Server6.0.2.25—
IbmWebsphere Application Server6.0.2.28—
IbmWebsphere Application Server6.0.2.29—
IbmWebsphere Application Server6.0.2.30—
IbmWebsphere Application Server6.0.2.31—
IbmWebsphere Application Server6.0.2.32—
IbmWebsphere Application Server6.0.2.33—
IbmWebsphere Application Server6.1—
IbmWebsphere Application Server6.1.0—
IbmWebsphere Application Server6.1.0.0—
IbmWebsphere Application Server6.1.0.1—
IbmWebsphere Application Server6.1.0.2—
IbmWebsphere Application Server6.1.0.3—
IbmWebsphere Application Server6.1.0.4—
IbmWebsphere Application Server6.1.0.5—
IbmWebsphere Application Server6.1.0.6—

Showing 50 of 92 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2009-0217?
The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.
How severe is CVE-2009-0217?
Severity scoring for CVE-2009-0217 is pending analysis. The EPSS model estimates a 6.35% probability of exploitation in the next 30 days.
How do I fix CVE-2009-0217?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2009-0217?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST