CVE-2011-1096

MEDIUM

Description

The W3C XML Encryption Standard, as used in the JBoss Web Services (JBossWS) component in JBoss Enterprise Portal Platform before 5.2.2 and other products, when using block ciphers in cipher-block chaining (CBC) mode, allows remote attackers to obtain plaintext data via a chosen-ciphertext attack on SOAP responses, aka "character encoding pattern attack."

References

http://aktuell.ruhr-uni-bochum.de/pm2011/pm00330.html.de

http://coheigea.blogspot.com/2012/04/note-on-cve-2011-1096.html

http://cxf.apache.org/note-on-cve-2011-1096.html

http://dl.acm.org/citation.cfm?id=2046756&dl=ACM&coll=DL

http://rhn.redhat.com/errata/RHSA-2012-1301.html

http://rhn.redhat.com/errata/RHSA-2012-1330.html

http://rhn.redhat.com/errata/RHSA-2012-1344.html

http://rhn.redhat.com/errata/RHSA-2013-0191.html

http://rhn.redhat.com/errata/RHSA-2013-0192.html

http://rhn.redhat.com/errata/RHSA-2013-0193.html

http://rhn.redhat.com/errata/RHSA-2013-0194.html

http://rhn.redhat.com/errata/RHSA-2013-0195.html

http://rhn.redhat.com/errata/RHSA-2013-0196.html

http://rhn.redhat.com/errata/RHSA-2013-0197.html

http://rhn.redhat.com/errata/RHSA-2013-0198.html

http://rhn.redhat.com/errata/RHSA-2013-0221.html

http://rhn.redhat.com/errata/RHSA-2013-0261.html

http://rhn.redhat.com/errata/RHSA-2013-1437.html

http://secunia.com/advisories/51984

http://secunia.com/advisories/52054

http://www.csoonline.com/article/692366/widely-used-encryption-standard-is-insecure-say-experts

http://www.securityfocus.com/bid/55770

https://bugzilla.redhat.com/show_bug.cgi?id=681916

https://exchange.xforce.ibmcloud.com/vulnerabilities/79031

https://lists.apache.org/thread.html/[email protected]%3Ccommits.cxf.apache.org%3E

Details

Source: MITRE

Published: 2012-11-23

Updated: 2019-03-27

Type: CWE-310

Risk Information

CVSS v2.0

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM