Vulnerability fixes

[Cantor, Scott]

On 12/23/14, 7:06 PM, "Sathish Anickode" 
<SAnickode at skytouchtechnology.com> wrote:

>I am currently using Shibboleth 2.4.3 as the Identity Provider and would 
>like to verify if this version includes fixes for XML Signature and 
>Encryption wrapping vulnerabilities.

That depends entirely on what issues you're concerned about. The only 
known signature attacks are discussed in the advisory [1] and it already 
answers your question.

XML Encryption doesn't have "wrapping" attacks, it has disclosure 
vulnerabilities when used with specific algorithms, most of which are 
unavoidable in practice, and the reverse incentives associated with fixing 
them make it difficult to address. All the IdP can do is use the right 
algorithms (AES-GCM) and 2.x does not support them because Java didn't 
until very recently.

There are no simple answers where encryption is concerned. A paper barely 
covers it, let alone an email.

> I would also like to know if I have to be aware of any default
> configuration that needs to be changed to ensure that countermeasures 
>are in place.

The only setting relevant to anything you're asking about is to ensure 
that SAML responses are always signed, but since few if any SPs would 
actually reject unsigned responses, it's nothing more than being a good 
citizen to do it.

-- Scott

[1] http://shibboleth.net/community/advisories/secadv_20110725.txt