Shibboleth Service Provider Security Advisory [2018-01-12]

[Steven Carmody]

question from our security officer -- has the SHib project considered 
getting CVE numbers for these advisories ?

On 1/12/18 10:37 AM, Cantor, Scott wrote:
>   -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
> 
> 
> Shibboleth Service Provider Security Advisory [12 January 2018]
> 
> An updated version of the Shibboleth Project's XMLTooling library is
> available which corrects a critical security issue.
> 
> 
> Shibboleth SP software vulnerable to forged user attribute data
> ====================================================================
> The Service Provider software relies on a generic XML parser to process
> SAML responses and there are limitations in older versions of the parser
> that make it impossible to fully disable Document Type Definition (DTD)
> processing.
> 
> Through addition/manipulation of a DTD, it's possible to make changes
> to an XML document that do not break a digital signature but are
> mishandled by the SP and its libraries. These manipulations can alter
> the user data passed through to applications behind the SP and result
> in impersonation attacks and exposure of protected information.
> 
> While the use of XML Encryption can serve as a mitigation for this bug,
> it may still be possible to construct attacks in such cases, and the SP
> does not provide a means to enforce its use.
> 
> An updated version of XMLTooling-C (V1.6.3) is available that works
> around this specific bug.
> 
> While newer versions of the parser are configured by the SP into
> disallowing the use of a DTD via an environment variable, this feature
> is not present in the parser used on some supported platforms (notably
> Red Hat and CentOS 7), so an additional fix is being provided now that
> an actual DTD exploit has been identified.
> 
> While it is possible to determine whether one is already immune to this
> bug, the installation of this patch is a simpler step, and strongly
> encouraged. Notably, however "current" Windows installs of V2.6.0 and
> later are *not* impacted by the bug, so this patch can be treated as lower
> priority on that platform.
> 
> This vulnerability has been assigned CVE-2018-0486.
> 
> Recommendations
> ===============
> Upgrade to V1.6.3 or later of the XMLTooling-C library and restart the
> affected processes (shibd, Apache, etc.)
> 
> Linux installations relying on official RPM packages can upgrade to
> the latest package versions to obtain the fix.
> 
> The MacPort has also been updated.
> 
> Windows systems can upgrade to the latest Service Provider release
> (V2.6.1.3) which contains the appropriately updated libraries. [1]
> 
> 
> Credits
> =======
> Philip Huppert, RedTeam Pentesting
> 
> [1] https://shibboleth.net/downloads/service-provider/2.6.1/
> 
> URL for this Security Advisory:
> https://shibboleth.net/community/advisories/secadv_20180112.txt
> 
> -----BEGIN PGP SIGNATURE-----
> 
> iQIzBAEBCgAdFiEE3KoVAHvtneaQzZUjN4uEVAIneWIFAlpY1OAACgkQN4uEVAIn
> eWKIhw//RXdMFS0ez8N7+9b9HGoPdWXVPvw+LGK0aVL2tkhHeRiDvzrIJng4o/35
> Mm6e02dm4YI2U0aObUH9Ns0AQZLCzUblOaVupysd0NWy0imvieJJHGDuoWLR9DeP
> ehLH8FOKlGjNHGcmkf70JWpVWPFCdO3J0PXdxrFey2dHbAu5Npf5aQanIvrEtiDu
> lAvBrEJKasRxZ9zXjrc6Nl7C6Mk+7LOuZLYj2XaQeriRxMWER5ArStdk4VCBxq1G
> g3RELwdWxwRM3dCg+kQMZTkClvL/uYwJbSrlk6JQus80drJ2u8tPjuRMFkhvBm15
> ylEU6d123vISZqRiKoVGsHhz9p3W+EJ5TfWwq8mrxHRLBwyvVVyHePT0aQmGdxiC
> +uHp4jOiPYh0FLWNqRioo79rOtxpHKQXMqCSoA9v9DtfESkYr/lw4mXcL+ZySY9n
> 6UXVihz5PLMaqMXWuX590xGIcSpnihMFBOGxymQ8CqNfUhrxZpHsrfh6b78iqIV+
> EsOan7w5XJ9GifaOsVy2nT5u5TQ9KQpz9UFAUfNxQ4DiRk6x1sTPnLj0gSy+ttn6
> S63QnT6PkIzGdgl+60BXmKiL+4vgYdBetfe3o9ZPFL2zs4nVQxw20zqbyh2ZZZ3Z
> x9NrMwuDL6IUiK+pdfsVL5EL7UKokmVKRDERit5ElrxzmpT25qA=
> =fxWs
> -----END PGP SIGNATURE-----
> 
> --
> To unsubscribe from this list send an email to announce-unsubscribe at shibboleth.net
>