JBossWS Endpoint Uses Unsafe Encryption
medium Nessus Plugin ID 66190
Language:
New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.
VPR Score: 3.4
Synopsis
A Java-based web service running on the remote host uses an unsafe encryption method.Description
The W3C XML Encryption Standard, implemented in JBossWS and used by one or more endpoints on the remote host, contains a design error. The design error allows unauthenticated, remote attackers to decrypt captured SOAP responses via a chosen-ciphertext attack. This issue affects all block ciphers used in cipher-block chaining (CBC) mode.Solution
Upgrade the JBoss server to one of the patched versions listed in the vendor advisory, and enable galois/counter mode (GCM).See Also
https://bugzilla.redhat.com/show_bug.cgi?id=681916
https://access.redhat.com/security/cve/cve-2011-1096
Plugin Details
Severity: Medium
ID: 66190
File Name: jboss_ws_xmlenc.nbin
Version: 1.59
Type: remote
Family: CGI abuses
Published: 4/23/2013
Updated: 4/7/2021
Dependencies: jboss_ws_enum.nasl
Risk Information
Risk Factor: Medium
VPR Score: 3.4
CVSS Score Source: CVE-2011-1096
CVSS v2.0
Base Score: 5
Temporal Score: 4.1
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Temporal Vector: E:F/RL:OF/RC:C
Vulnerability Information
CPE: x-cpe:/a:jboss:jbossws
Required KB Items: JBossWS
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 10/19/2011
Vulnerability Publication Date: 10/19/2011
Reference Information
CVE: CVE-2011-1096
BID: 55770