Shibboleth SP crashing during signature computation

[Cantor, Scott]

On 7/13/12 10:07 AM, "Rob Whitener" <rob.whitener at audaxhealth.com> wrote:
>
>I believe the version of libxml-security we are using is 15.0.1 :

Well, that's vulnerable to the bug I was talking about, not that I
necessarily think that's the cause unless your key is extremely large.

But you can't be using packages that have security holes. Unless you know
that these include backported patches like Debian's do, your system is
vulnerable to remote exploit anyway because there are more serious bugs in
the rest of the stack in V2.3.

>The key we are using is 1675 bytes including the begin and end
>delimitters, and its RSA.

That's not the key size I mean, the issue is the size in bits of the
modulus.

>Also, I am going to try attaching the debugger to try and get a stack
>trace, but first I thought I would try out the simple route of turning
>off the signing to see if that solves it.  If I remove this element:
>
><PolicyRule type="XMLSigning" errorFatal="true"/>
>
>from my <Policy> element, is that what turns off the signing?

No, that turns off verification. Which is somewhat moot because a
non-patched 2.3 SP is open to signature wrapping attack anyway, as
described in the advisory we issued.

Turning off signing requires changing the signing property in the
shibboleth2.xml file or adjusting the IdP's metadata to turn off the
wantAuthnRequestSigned flag.

-- Scott