CNVD-2017-06141

Vulnerability from cnvd - Published: 2017-05-09
VLAI
Title
Apache CXF服务器欺骗漏洞
Description
Apache CXF是美国阿帕奇（Apache）软件基金会的一个开源的Web服务框架。该框架支持多种Web服务标准、多种前端编程API等。JAX-RSXML Security streaming clients是其中的一个使用XML签名和XML加密来保护JAX-RS客户端和端点的客户端。 Apache CXF中的JAX-RSXML Security streaming clients客户端存在安全漏洞，该漏洞源于程序未能验证服务响应是否签名或加密。远程攻击者可利用该漏洞欺骗服务器。
Severity
中
Patch Name
Apache CXF服务器欺骗漏洞的补丁
Patch Description
Apache CXF是美国阿帕奇（Apache）软件基金会的一个开源的Web服务框架。该框架支持多种Web服务标准、多种前端编程API等。JAX-RSXML Security streaming clients是其中的一个使用XML签名和XML加密来保护JAX-RS客户端和端点的客户端。 Apache CXF中的JAX-RSXML Security streaming clients客户端存在安全漏洞，该漏洞源于程序未能验证服务响应是否签名或加密。远程攻击者可利用该漏洞欺骗服务器。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

厂商已发布了漏洞修复程序，请及时关注更新： http://cxf.apache.org/security-advisories.data/CVE-2017-5653.txt.asc?version=1&modificationDate=1492515074710&api=v2

Reference
http://cxf.apache.org/security-advisories.data/CVE-2017-5653.txt.asc?version=1&modificationDate=1492515074710&api=v2
Impacted products
Name
Apache CXF >=3.1.11，<=3.0.1
Show details on source website
To clipboard 

{
  "bids": {
    "bid": {
      "bidNumber": "97968"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-5653"
    }
  },
  "description": "Apache CXF\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2a\u5f00\u6e90\u7684Web\u670d\u52a1\u6846\u67b6\u3002\u8be5\u6846\u67b6\u652f\u6301\u591a\u79cdWeb\u670d\u52a1\u6807\u51c6\u3001\u591a\u79cd\u524d\u7aef\u7f16\u7a0bAPI\u7b49\u3002JAX-RSXML Security streaming clients\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u4f7f\u7528XML\u7b7e\u540d\u548cXML\u52a0\u5bc6\u6765\u4fdd\u62a4JAX-RS\u5ba2\u6237\u7aef\u548c\u7aef\u70b9\u7684\u5ba2\u6237\u7aef\u3002\r\n\r\nApache CXF\u4e2d\u7684JAX-RSXML Security streaming clients\u5ba2\u6237\u7aef\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u9a8c\u8bc1\u670d\u52a1\u54cd\u5e94\u662f\u5426\u7b7e\u540d\u6216\u52a0\u5bc6\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6b3a\u9a97\u670d\u52a1\u5668\u3002",
  "discovererName": "Apache",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttp://cxf.apache.org/security-advisories.data/CVE-2017-5653.txt.asc?version=1\u0026modificationDate=1492515074710\u0026api=v2",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-06141",
  "openTime": "2017-05-09",
  "patchDescription": "Apache CXF\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2a\u5f00\u6e90\u7684Web\u670d\u52a1\u6846\u67b6\u3002\u8be5\u6846\u67b6\u652f\u6301\u591a\u79cdWeb\u670d\u52a1\u6807\u51c6\u3001\u591a\u79cd\u524d\u7aef\u7f16\u7a0bAPI\u7b49\u3002JAX-RSXML Security streaming clients\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u4f7f\u7528XML\u7b7e\u540d\u548cXML\u52a0\u5bc6\u6765\u4fdd\u62a4JAX-RS\u5ba2\u6237\u7aef\u548c\u7aef\u70b9\u7684\u5ba2\u6237\u7aef\u3002\r\n\r\nApache CXF\u4e2d\u7684JAX-RSXML Security streaming clients\u5ba2\u6237\u7aef\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u9a8c\u8bc1\u670d\u52a1\u54cd\u5e94\u662f\u5426\u7b7e\u540d\u6216\u52a0\u5bc6\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6b3a\u9a97\u670d\u52a1\u5668\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache CXF\u670d\u52a1\u5668\u6b3a\u9a97\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Apache CXF \u003e=3.1.11\uff0c\u003c=3.0.1"
  },
  "referenceLink": "http://cxf.apache.org/security-advisories.data/CVE-2017-5653.txt.asc?version=1\u0026amp;amp;modificationDate=1492515074710\u0026amp;amp;api=v2",
  "serverity": "\u4e2d",
  "submitTime": "2017-04-21",
  "title": "Apache CXF\u670d\u52a1\u5668\u6b3a\u9a97\u6f0f\u6d1e"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.