Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/

SYNTHESIS OF THE VULNERABILITY
An attacker who captured encrypted JAX-RPC or JAX-WS data can
decrypt them.

– Severity: 2/4
– Creation date: 18/04/2011

IMPACTED PRODUCTS

– IBM WebSphere Application Server

DESCRIPTION OF THE VULNERABILITY

The WS-Security protocol is used to sign and encrypt SOAP
exchanges. It uses XML-DSig and XML-Enc, which sign and encrypt
XML data.

Queries to Web Services JAX-RPC/JAX-WS can be encrypted with
WS-Security. However, these data can be decrypted without the key.
Technical details are unknown.

An attacker who captured encrypted JAX-RPC or JAX-WS data can
therefore decrypt them.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/WebSphere-AS-decryption-of-JAX-RPC-or-JAX-WS-10574