Vulnerability Note VU#466161

XML signature HMAC truncation authentication bypass

Original Release date: 14 Jul 2009 | Last revised: 05 Aug 2009

Overview

The XML Signature specification allows for HMAC truncation, which may allow a remote attacker to bypass authentication.

Description

XML Signature Syntax and Processing (XMLDsig) is a W3C recommendation for providing integrity, message authentication, and/or signer authentication services for data. XMLDsig is commonly used by web services such as SOAP. The XMLDsig recommendation includes support for HMAC truncation, as specified in RFC2104. However, the XMLDsig specification does not follow the RFC2104 recommendation to not allow truncation to less than half of the length of the hash output or less than 80 bits. When HMAC truncation is under the control of an attacker this can result in an effective authentication bypass. For example, by specifying an HMACOutputLength of 1, only one bit of the signature is verified. This can allow an attacker to forge an XML signature that will be accepted as valid.

Impact

This vulnerability can allow an attacker to bypass the authentication mechanism provided by the XML Signature specification.

Solution

Apply an update

Please check with your vendor for available updates. Erratum E03 for the XMLDsig recommendation has been added, which specifies minimum values for HMAC truncation.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Apache XML SecurityAffected-14 Jul 2009
Apple Inc.Affected09 Jul 200910 Jul 2009
Debian GNU/LinuxAffected09 Jul 200914 Jul 2009
IBM CorporationAffected09 Jul 200914 Jul 2009
Mono-ProjectAffected-10 Jul 2009
Oracle CorporationAffected-13 Jul 2009
RSA Security, Inc.Affected-14 Jul 2009
Sun Microsystems, Inc.Affected09 Jul 200905 Aug 2009
XML Security LibraryAffected-10 Jul 2009
Force10 Networks, Inc.Not Affected09 Jul 200914 Jul 2009
m0n0wallNot Affected09 Jul 200910 Jul 2009
PePLinkNot Affected09 Jul 200920 Jul 2009
Q1 LabsNot Affected09 Jul 200910 Jul 2009
The SCO GroupNot Affected09 Jul 200913 Jul 2009
VMwareNot Affected09 Jul 200914 Jul 2009
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Thomas Roessler of the W3C for reporting this vulnerability.

This document was written by Will Dormann.

Other Information

  • CVE IDs: CVE-2009-0217
  • Date Public: 14 Jul 2009
  • Date First Published: 14 Jul 2009
  • Date Last Updated: 05 Aug 2009
  • Severity Metric: 8.16
  • Document Revision: 28

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.