CVE-2013-2155

Apache Santuario XML Security para C++ (aka xml-security-c) anterior a 1.7.1, no valida adecuadamente los valores relativos al tamaño, lo que permite a atacantes remotos provocar una denegación de servicio o evitar los mecanismos de protección (CVE-2009-0217) y suplantar una firma a través de tamaños de valores manipulados en las funciones (1) compareBase64StringToRaw, (2) DSIGAlgorithmHandlerDefault, o (3) DSIGAlgorithmHandlerDefault::verify.

A bug exists in the processing of the output length of an HMAC-based XML Signature that would cause a denial of service when processing specially chosen input. Exploitation of this issue does not require authenticated content. In very unusual cases, inputs could be chosen in such a way that the fix for the issue in CVE-2009-0217 could be bypassed, enabling improper verification of a signature. Versions prior to 1.7.1 are affected.