Shibboleth Security Advisory [23 January 2018]

[Peter Schober]

* Mark Cairney <Mark.Cairney at ed.ac.uk> [2018-01-25 12:38]:
> Thanks for your responses. It definitely makes more sense of the
> situation. At the moment we do have some SPs still using SAML1
> Attribute Queries but this made us identify them and start chasing
> up the ones we can.

Assuming the data sent to such SPs is rather innocuous
(e.g. eduPersonScopedAffiliation or common-lib-terms for library
services) you could consider pushing those over the browser
(unencrypted) and see whether the SP can digest them that way.

That would hopefully avoid queries from such SPs much faster than
trying to get them to support SAML2 (which you probably should still
push for, of course.)

> As it turns out the back-channel was a red herring and it was the
> main 443 channel that was flagged as vulnerable by our federation's
> scanner.  By a complete coincidence we just applied a firmware
> update to our Netscalers which has resolved this.

Since the TLS cert on the loadbalancer likely won't be the same as
your SAML cert(s) this means you shouldn't have to worry about
fraudulent assertions with valid signatures from your IDP.

-peter