Shibboleth SP crashing during signature computation

[Rob Whitener]

Hi Scott,

Ok, so our ApplicationDefaults element in shibboleth2.xml looks like this:

<ApplicationDefaults id="default" policyId="default"
        entityID="https://www.dev.careverge.com/shibboleth-sp"
        homeURL="https://www.dev.careverge.com"
        REMOTE_USER="eppn persistent-id targeted-id"
        signing="false" encryption="false">

But this is in the metadata they gave us:

<md:IDPSSODescriptor WantAuthnRequestsSigned="true"
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

So I am guessing they are forcing us to sign our requests.  I will see what
sort of hell we will have to go through to get them to turn that off (we
are very small, they are very big).

Given that we are on a downleveled version of both Shibboleth and Ubuntu,
will dropping in the patched version of libxml-security help us close the
security hole or will we need to upgrade everything.

Thanks,

Rob

On Fri, Jul 13, 2012 at 11:56 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/13/12 10:07 AM, "Rob Whitener" <rob.whitener at audaxhealth.com> wrote:
> >
> >I believe the version of libxml-security we are using is 15.0.1 :
>
> Well, that's vulnerable to the bug I was talking about, not that I
> necessarily think that's the cause unless your key is extremely large.
>
> But you can't be using packages that have security holes. Unless you know
> that these include backported patches like Debian's do, your system is
> vulnerable to remote exploit anyway because there are more serious bugs in
> the rest of the stack in V2.3.
>
> >The key we are using is 1675 bytes including the begin and end
> >delimitters, and its RSA.
>
> That's not the key size I mean, the issue is the size in bits of the
> modulus.
>
> >Also, I am going to try attaching the debugger to try and get a stack
> >trace, but first I thought I would try out the simple route of turning
> >off the signing to see if that solves it.  If I remove this element:
> >
> ><PolicyRule type="XMLSigning" errorFatal="true"/>
> >
> >from my <Policy> element, is that what turns off the signing?
>
> No, that turns off verification. Which is somewhat moot because a
> non-patched 2.3 SP is open to signature wrapping attack anyway, as
> described in the advisory we issued.
>
> Turning off signing requires changing the signing property in the
> shibboleth2.xml file or adjusting the IdP's metadata to turn off the
> wantAuthnRequestSigned flag.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120713/a3b27cf9/attachment.html