MS15-034 | Vulnerability in HTTP.sys Could Allow Remote Code Execution (3042553)

[Phil Lello]

> >Very good point. I guess it's just on my mind as I'm putting together a
> proposal to patch the code behind a Shib IdP RemoteUser check to chain on
> to an ADFS IdP rather than throwing up a form that does an LDAP-bind
> against AD (all part of the joy of using Office365 for email, needing a
> WS-Trust based IdP for things like Lync, and various internal web apps that
> authenticate directly against the system RemoteUser chains too).
>
> So I guess that whole move by MS to browser login for all the apps isn't
> moving along very quickly then...?
>
>
See
http://blogs.office.com/2014/11/12/office-2013-updated-authentication-enabling-multi-factor-authentication-saml-identity-providers/
paying special attention to "*There is no change to the way sign in works
in the Office clients after you have the update. By default the new ADAL
based authentication stack is disabled. The new authentication features
must be enabled on each client machine and also for the Office 365 tenant
that you are connecting to.* "

Getting that configured on all the potential desktops, let alone
mobile/tablet devices (assuming they are even running appropriate versions
of software) is unfortunately not a realistic goal, and inevitably it will
be users like Prince Ipal and Dean O'Faculty that would be hit by switching
ADFS to use Shibboleth.

Phil
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150416/aca39432/attachment.html