Heap-based buffer overflow in the Exclusive Canonicalization functionality (xsec/canon/XSECC14n20010315.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PrefixList attribute.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is 5.7.1 or earlier. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues nor the stand-alone patch but has instead relied only on the application's self-reported version number.

The Apache Software Foundation reports :

A heap overflow exists in the processing of the PrefixList attribute optionally used in conjunction with Exclusive Canonicalization, potentially allowing arbitary code execution. If verification of the signature occurs prior to actual evaluation of a signing key, this could be exploited by an unauthenticated attacker.

James Forshaw from Context Information Security discovered several vulnerabilities in xml-security-c, an implementation of the XML Digital Security specification. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2013-2153     The implementation of XML digital signatures in the     Santuario-C++ library is vulnerable to a spoofing issue     allowing an attacker to reuse existing signatures with     arbitrary content.

  - CVE-2013-2154     A stack overflow, possibly leading to arbitrary code     execution, exists in the processing of malformed     XPointer expressions in the XML Signature Reference     processing code.

  - CVE-2013-2155     A bug in the processing of the output length of an     HMAC-based XML Signature would cause a denial of service     when processing specially chosen input.

  - CVE-2013-2156     A heap overflow exists in the processing of the     PrefixList attribute optionally used in conjunction with     Exclusive Canonicalization, potentially allowing     arbitrary code execution.

ID	Name	Product	Family	Severity
119149	Tenable SecurityCenter < 5.8.0 Multiple Vulnerabilities (TNS-2018-15)	Nessus	Misc.	critical
66918	FreeBSD : apache-xml-security-c -- heap overflow (279e5f4b-d823-11e2-928e-08002798f6ff)	Nessus	FreeBSD Local Security Checks	high
66917	Debian DSA-2710-1 : xml-security-c - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2013-2156

critical

Tenable Plugins

critical

high

high