CVE-2011-4314: Input Validation
First published: Fri Jan 27 2012(Updated: )
message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Openid Openid4java | <=0.9.5.593 | |
| Kay Framework Project Kay Framework | =1.0.0 | |
| Redhat Jboss Enterprise Application Platform | =5.1.2 | |
| Openid Openid4java | =0.9.2 | |
| Kay Framework Project Kay Framework | =0.1.0 | |
| Redhat Jboss Enterprise Application Platform | =5.1.1 | |
| Kay Framework Project Kay Framework | <=1.0.1 | |
| Kay Framework Project Kay Framework | =0.8.0 | |
| Kay Framework Project Kay Framework | =0.2.0 | |
| Redhat Jboss Enterprise Application Platform | =5.1.0 | |
| Openid Openid4java | =0.9.4.339 | |
| Openid Openid4java | =0.9.3 | |
| Kay Framework Project Kay Framework | =0.0.0 | |
| Kay Framework Project Kay Framework | =0.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://securitytracker.com/id?1026400
- http://www.redhat.com/support/errata/RHSA-2011-1804.html
- https://issues.jboss.org/browse/SOA-3597
- https://issues.jboss.org/browse/JBEPP-1368
- http://secunia.com/advisories/44496
- http://openid.net/2011/05/05/attribute-exchange-security-alert/
- http://www.openwall.com/lists/oss-security/2011/11/16/1
- http://www.openwall.com/lists/oss-security/2011/11/17/1
- http://rhn.redhat.com/errata/RHSA-2012-0441.html
- http://rhn.redhat.com/errata/RHSA-2012-0519.html
- http://secunia.com/advisories/48697
- http://secunia.com/advisories/48954
- collector/nvd-historical
- collector/nvd-index
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/description
- agent/type
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/remedy
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/openid
- canonical/openid openid4java
- version/openid openid4java/0.9.5.593
- vendor/kay framework project
- canonical/kay framework project kay framework
- version/kay framework project kay framework/1.0.0
- vendor/redhat
- canonical/redhat jboss enterprise application platform
- version/redhat jboss enterprise application platform/5.1.2
- version/openid openid4java/0.9.2
- version/kay framework project kay framework/0.1.0
- version/redhat jboss enterprise application platform/5.1.1
- version/kay framework project kay framework/1.0.1
- version/kay framework project kay framework/0.8.0
- version/kay framework project kay framework/0.2.0
- version/redhat jboss enterprise application platform/5.1.0
- version/openid openid4java/0.9.4.339
- version/openid openid4java/0.9.3
- version/kay framework project kay framework/0.0.0
- version/kay framework project kay framework/0.3.0