Summary
The remote host is missing an update to xml-security-c announced via advisory DSA 2277-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202277-1
Insight
It has been discovered that xml-security-c, an implementation of the XML Digital Signature and Encryption specifications, is not properly handling RSA keys of sizes on the order of 8192 or more bits. This allows an attacker to crash applications using this functionality or potentially execute arbitrary code by tricking an application into verifying a signature created with a sufficiently long RSA key.
For the oldstable distribution (lenny), this problem has been fixed in version 1.4.0-3+lenny3.
For the stable distribution (squeeze), this problem has been fixed in version 1.5.1-3+squeeze1.
For the testing distribution (wheezy), this problem will be fixed soon.
For the unstable distribution (sid), this problem has been fixed in version 1.6.1-1.
We recommend that you upgrade your xml-security-c packages.
Severity
Classification
-
CVE CVE-2011-2516 -
CVSS Base Score: 5.0
AV:N/AC:L/Au:N/C:N/I:N/A:P
Related Vulnerabilities