CVE-2011-4314

Name of the Vulnerable Software and Affected Versions OpenID4Java versions prior to 0.9.6 final JBoss Enterprise Application Platform versions prior to 5.1.2 Kay Framework versions prior to 1.0.2

Description The issue allows remote attackers to modify potentially sensitive Attribute Exchange (AX) information without detection via a man-in-the-middle (MITM) attack, as the message/ax/AxMessage.java in OpenID4Java does not verify that AX information is signed.

Recommendations For OpenID4Java versions prior to 0.9.6 final, update to version 0.9.6 final or later. For JBoss Enterprise Application Platform versions prior to 5.1.2, update to version 5.1.2 or later. For Kay Framework versions prior to 1.0.2, update to version 1.0.2 or later.