NVD Vulnerability Detail

CVE-2014-3623

Summary	Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
Publication Date	Oct. 30, 2014, 11:55 p.m.
Registration Date	Jan. 26, 2021, 3:11 p.m.
Last Update	Nov. 21, 2024, 11:08 a.m.

CVSS2.0 : MEDIUM
Score	5.0
Vector	AV:N/AC:L/Au:N/C:N/I:P/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	低
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apache:wss4j::::::::				1.6.17
cpe:2.3:a:apache:wss4j::::::::	2.0.0			2.0.2

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:apache:cxf::::::::	3.0.0			3.0.2
cpe:2.3:a:apache:cxf::::::::	2.7.0	2.7.13

Related information, measures and tools

No	URL	タグ
1	http://rhn.redhat.com/errata/RHSA-2015-0236.html	Third Party Advisory
2	http://rhn.redhat.com/errata/RHSA-2015-0236.html	Third Party Advisory
3	http://rhn.redhat.com/errata/RHSA-2015-0675.html	Third Party Advisory
4	http://rhn.redhat.com/errata/RHSA-2015-0675.html	Third Party Advisory
5	http://rhn.redhat.com/errata/RHSA-2015-0850.html	Third Party Advisory
6	http://rhn.redhat.com/errata/RHSA-2015-0850.html	Third Party Advisory
7	http://rhn.redhat.com/errata/RHSA-2015-0851.html	Third Party Advisory
8	http://rhn.redhat.com/errata/RHSA-2015-0851.html	Third Party Advisory
9	http://seclists.org/oss-sec/2014/q4/437	Mailing List Third Party Advisory
10	http://seclists.org/oss-sec/2014/q4/437	Mailing List Third Party Advisory
11	http://secunia.com/advisories/61909	Third Party Advisory
12	http://secunia.com/advisories/61909	Third Party Advisory
13	http://www.securityfocus.com/bid/70736	Third Party Advisory VDB Entry
14	http://www.securityfocus.com/bid/70736	Third Party Advisory VDB Entry
15	https://exchange.xforce.ibmcloud.com/vulnerabilities/97754	VDB Entry
16	https://exchange.xforce.ibmcloud.com/vulnerabilities/97754	VDB Entry
17	https://issues.apache.org/jira/browse/WSS-511	Vendor Advisory
18	https://issues.apache.org/jira/browse/WSS-511	Vendor Advisory
19	https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E
20	https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E
21	https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E
22	https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E
23	https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E
24	https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E
25	https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E
26	https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E
27	https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
28	https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
29	https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E
30	https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-287	不適切な認証	https://cwe.mitre.org/data/definitions/287.html

JVN Vulnerability Information

Apache CXF で使用される Apache WSS4J におけるスプーフィング攻撃を実行される脆弱性

Title	Apache CXF で使用される Apache WSS4J におけるスプーフィング攻撃を実行される脆弱性
Summary	Apache CXF で使用される Apache WSS4J は、TransportBinding を使用している場合、SAML SubjectConfirmation メソッドのセキュリティセマンティックを適切に適用しないため、スプーフィング攻撃を実行される脆弱性が存在します。
Possible impacts	第三者により、スプーフィング攻撃を実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 11, 2014, midnight
Registration Date	Nov. 4, 2014, 2:18 p.m.
Last Update	June 22, 2015, 6:18 p.m.

Affected System

Apache Software Foundation

Apache CXF 2.7.13 未満の 2.7.x

Apache CXF 3.0.2 未満の 3.0.x

Apache WSS4J 1.6.17 未満

Apache WSS4J 2.0.2 未満の 2.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Apache
1	CVE-2014-3623: Apache CXF does not properly enforce the security semantics of SAML SubjectConfirmation methods when used with the TransportBinding	http://cxf.apache.org/security-advisories.data/CVE-2014-3623.txt.asc?version=1&modificationDate=1414169368341&api=v2
Common Vulnerabilities and Exposures (CVE)
2	CVE-2014-3623	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3623
National Vulnerability Database (NVD)
3	CVE-2014-3623	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3623

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-287	https://jvndb.jvn.jp/ja/cwe/CWE-287.html

ベンダー情報

No	Name	URL
ASF JIRA
1	Provide a (default) way of requiring at least one standard Subject Confirmation Method	https://issues.apache.org/jira/browse/WSS-511
Red Hat Security Advisory
2	RHSA-2015:0236	https://rhn.redhat.com/errata/RHSA-2015-0236.html
3	RHSA-2015:0675	https://rhn.redhat.com/errata/RHSA-2015-0675.html
4	RHSA-2015:0850	https://rhn.redhat.com/errata/RHSA-2015-0850.html
5	RHSA-2015:0851	https://rhn.redhat.com/errata/RHSA-2015-0851.html

その他

No	Name	URL
関連文書
1	Apache CXF SAML security bypass	http://xforce.iss.net/xforce/xfdb/97754

Change Log

No	Changed Details	Date of change
0	[2014年11月04日] 掲載 [2015年05月08日] ベンダ情報：レッドハット (RHSA-2015:0675) を追加ベンダ情報：レッドハット (RHSA-2015:0850) を追加ベンダ情報：レッドハット (RHSA-2015:0851) を追加 [2015年06月22日] ベンダ情報：レッドハット (RHSA-2015:0236) を追加	Feb. 17, 2018, 10:37 a.m.