disclosure of IP address in cookie

[Peter Schober]

* Gruber Bernhard SAI sIT <Bernhard.Gruber at s-itsolutions.at> [2013-07-05 11:40]:
> During a security test of our shibboleth base solution, the
> following issue was reported to us:

This mailing list not the proper way to report (percieved) security issues:

  "If you [...] would like to report a potentially security sensitive
   issue with one of the products, please use the form below or send an
   email to contact at shibboleth.net.
   http://shibboleth.net/about/contact.html

> The iDP component discloses an internal IP address in the value of
> the _idp_lc_session cookie. The truncated and base64 decoded value
> of the cookie is as follows.

I can't find the string "_idp_lc_session" (or "_idp_lc_") in the IdP's
source code, so unless I'm looking at the wrong code (very well
possible) an unmodified IdP does not set a cookie with that name.

> 127.0.0.1|<sessionID>

IDP_SESSION_COOKIE_NAME (defaulting to "_idp_session") has a somewhat
similar format, and does include the HTTP User Agent's own IP address.

Personal note (IMHO): I somehow doubt an attacker needs that cookie
only to find out a client's IP address. S/he either attacks the client
or the network the client is on, in which case the client's IP address
will be apparent, or attacks the IdP (or the network the IdP is on),
where the client's IP address is known as well, without decoding HTTP
Cookie values.
Also note that that same IP address will be written into the
SubjectConfirmation/SubjectConfirmationData/@Address attribute in an
authentication assertion, which will be given out to relying parties.
-peter