{"id":"CVE-2009-0217","details":"The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.","aliases":["GHSA-8hfm-837h-hjg5"],"modified":"2026-04-10T03:40:35.370216Z","published":"2009-07-14T23:30:00Z","references":[{"type":"ADVISORY","url":"http://secunia.com/advisories/34461"},{"type":"ADVISORY","url":"http://secunia.com/advisories/35776"},{"type":"ADVISORY","url":"http://secunia.com/advisories/35852"},{"type":"ADVISORY","url":"http://secunia.com/advisories/35853"},{"type":"ADVISORY","url":"http://secunia.com/advisories/35854"},{"type":"ADVISORY","url":"http://secunia.com/advisories/35855"},{"type":"ADVISORY","url":"http://secunia.com/advisories/35858"},{"type":"ADVISORY","url":"http://secunia.com/advisories/36162"},{"type":"ADVISORY","url":"http://secunia.com/advisories/36176"},{"type":"ADVISORY","url":"http://secunia.com/advisories/36180"},{"type":"ADVISORY","url":"http://secunia.com/advisories/36494"},{"type":"ADVISORY","url":"http://secunia.com/advisories/37300"},{"type":"ADVISORY","url":"http://secunia.com/advisories/37671"},{"type":"ADVISORY","url":"http://secunia.com/advisories/37841"},{"type":"ADVISORY","url":"http://secunia.com/advisories/38567"},{"type":"ADVISORY","url":"http://secunia.com/advisories/38568"},{"type":"ADVISORY","url":"http://secunia.com/advisories/38695"},{"type":"ADVISORY","url":"http://secunia.com/advisories/38921"},{"type":"ADVISORY","url":"http://secunia.com/advisories/41818"},{"type":"ADVISORY","url":"http://secunia.com/advisories/60799"},{"type":"ADVISORY","url":"http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023545&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphere"},{"type":"ADVISORY","url":"http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023723&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphere"},{"type":"ADVISORY","url":"http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg21384925"},{"type":"ADVISORY","url":"http://www.debian.org/security/2010/dsa-1995"},{"type":"ADVISORY","url":"http://www.mandriva.com/security/advisories?name=MDVSA-2009:209"},{"type":"ADVISORY","url":"http://www.mono-project.com/Vulnerabilities"},{"type":"ADVISORY","url":"http://www.ubuntu.com/usn/USN-903-1"},{"type":"ADVISORY","url":"http://www.vupen.com/english/advisories/2009/1900"},{"type":"ADVISORY","url":"http://www.vupen.com/english/advisories/2009/1908"},{"type":"ADVISORY","url":"http://www.vupen.com/english/advisories/2009/1909"},{"type":"ADVISORY","url":"http://www.vupen.com/english/advisories/2009/1911"},{"type":"ADVISORY","url":"http://www.vupen.com/english/advisories/2009/2543"},{"type":"ADVISORY","url":"http://www.vupen.com/english/advisories/2009/3122"},{"type":"ADVISORY","url":"http://www.vupen.com/english/advisories/2010/0366"},{"type":"ADVISORY","url":"http://www.vupen.com/english/advisories/2010/0635"},{"type":"ADVISORY","url":"http://www.w3.org/2008/06/xmldsigcore-errata.html#e03"},{"type":"ADVISORY","url":"http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html"},{"type":"ADVISORY","url":"https://rhn.redhat.com/errata/RHSA-2009-1200.html"},{"type":"ADVISORY","url":"https://rhn.redhat.com/errata/RHSA-2009-1201.html"},{"type":"ADVISORY","url":"https://rhn.redhat.com/errata/RHSA-2009-1428.html"},{"type":"ADVISORY","url":"https://rhn.redhat.com/errata/RHSA-2009-1636.html"},{"type":"ADVISORY","url":"https://rhn.redhat.com/errata/RHSA-2009-1637.html"},{"type":"ADVISORY","url":"https://rhn.redhat.com/errata/RHSA-2009-1649.html"},{"type":"ADVISORY","url":"https://rhn.redhat.com/errata/RHSA-2009-1650.html"},{"type":"ARTICLE","url":"http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161"},{"type":"FIX","url":"http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023545&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphere"},{"type":"FIX","url":"http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023723&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphere"},{"type":"FIX","url":"http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg21384925"},{"type":"FIX","url":"http://www.securityfocus.com/bid/35671"},{"type":"FIX","url":"http://www.vupen.com/english/advisories/2009/1900"},{"type":"FIX","url":"http://www.vupen.com/english/advisories/2009/1908"},{"type":"FIX","url":"http://www.vupen.com/english/advisories/2009/1909"},{"type":"FIX","url":"http://www.vupen.com/english/advisories/2009/1911"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=511915"},{"type":"REPORT","url":"https://issues.apache.org/bugzilla/show_bug.cgi?id=47526"},{"type":"REPORT","url":"https://issues.apache.org/bugzilla/show_bug.cgi?id=47527"},{"type":"WEB","url":"http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7"},{"type":"WEB","url":"http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7"},{"type":"WEB","url":"http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html"},{"type":"WEB","url":"http://marc.info/?l=bugtraq&m=125787273209737&w=2"},{"type":"WEB","url":"http://osvdb.org/55895"},{"type":"WEB","url":"http://osvdb.org/55907"},{"type":"WEB","url":"http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1"},{"type":"WEB","url":"http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1"},{"type":"WEB","url":"http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1"},{"type":"WEB","url":"http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1"},{"type":"WEB","url":"http://svn.apache.org/viewvc?revision=794013&view=revision"},{"type":"WEB","url":"http://www.aleksey.com/xmlsec/"},{"type":"WEB","url":"http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml"},{"type":"WEB","url":"http://www.kb.cert.org/vuls/id/466161"},{"type":"WEB","url":"http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ"},{"type":"WEB","url":"http://www.kb.cert.org/vuls/id/WDON-7TY529"},{"type":"WEB","url":"http://www.openoffice.org/security/cves/CVE-2009-0217.html"},{"type":"WEB","url":"http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html"},{"type":"WEB","url":"http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html"},{"type":"WEB","url":"http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"},{"type":"WEB","url":"http://www.redhat.com/support/errata/RHSA-2009-1694.html"},{"type":"WEB","url":"http://www.securitytracker.com/id?1022561"},{"type":"WEB","url":"http://www.securitytracker.com/id?1022567"},{"type":"WEB","url":"http://www.securitytracker.com/id?1022661"},{"type":"WEB","url":"http://www.us-cert.gov/cas/techalerts/TA09-294A.html"},{"type":"WEB","url":"http://www.us-cert.gov/cas/techalerts/TA10-159B.html"},{"type":"WEB","url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041"},{"type":"WEB","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186"},{"type":"WEB","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158"},{"type":"WEB","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717"},{"type":"WEB","url":"https://usn.ubuntu.com/826-1/"},{"type":"WEB","url":"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html"},{"type":"WEB","url":"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html"},{"type":"WEB","url":"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html"},{"type":"WEB","url":"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html"}],"schema_version":"1.7.5"}