A security vulnerability with verifying HMAC-based XML digital signatures in the XML Digital Signature implementation included with webservices component of Sun GlassFish Enterprise Server may allow authentication to be bypassed. This could allow a user to forge an XML digital signature that would be accepted as valid. Applications that validate HMAC-based XML digital signatures may be vulnerable to this issue.

This issue is also described in the following documents:

CERT VU#466161 at:

• http://www.kb.cert.org/vuls/id/466161

CVE-2009-0217 at:

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0217

Sun acknowledges, with thanks, Thomas Roessler from the W3C for bringing this issue to our attention.

Permalink |