Bug 856755 (CVE-2012-4418)

Summary:	CVE-2012-4418 axis2: vulnerable to XML signature wrapping attacks
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	andjrobins, djorm, jrusnack, kdaniel, mgoldman, swagiaal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-03-08 05:37:49 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	919325
Bug Blocks:	755067

Description Jan Lieskovsky 2012-09-12 18:11:25 UTC

Apache Axis2, a web services, SOAP, and WSDL engine allows remote attackers to forge messages and bypass authentication via "XML Signature wrapping attack".

References:
[1] http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf
[2] http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-1411
[3] https://bugzilla.novell.com/show_bug.cgi?id=779901

Comment 1 Vincent Danen 2012-10-10 22:25:24 UTC

See also bug #865168 (CVE-2012-5158).

Comment 2 David Jorm 2013-03-08 05:28:26 UTC

Created axis2 tracking bugs for this issue

Affects: fedora-17 [bug 919325]

Comment 3 David Jorm 2013-03-08 05:37:49 UTC

Statement:

Not Vulnerable. This issue does not affect the version of axis as shipped with JBoss Developer Studio 5 and 6, JBoss Enterprise Portal Platform 5.2.2 and 6.0.0, Red Hat Enterprise Linux 5 and 6, and Red Hat Enterprise Virtualization Manager 3.1.