<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On 8 Apr 2014, at 17:54, Rich Graves <<a href="mailto:rgraves@carleton.edu">rgraves@carleton.edu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="font-family: Helvetica; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;">If you are using the native SP, which has process/privilege separation from the web server, I would not worry about replacing the SP keys. The vulnerability should only have exposed memory accessible to the httpd process. If you were using something like simpleSAMLphp then there could possibly be some concern.<br></div></div></blockquote><div><br></div><div>Not strictly true. It's not attackable through the web server, but when the Shibboleth daemon makes an outbound call to an IdP's SOAP endpoint (for artifact resolution or attribute query) then it's attackable back through that connection (either party can send the heartbeat packet).</div><div><br></div><div><span class="Apple-tab-span" style="font-size: 12px; orphans: 2; widows: 2; white-space: pre;"> </span><span style="font-size: 12px; orphans: 2; widows: 2;">-- Ian</span></div></div><div apple-content-edited="true"><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px;"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div><span class="Apple-style-span" style="font-size: medium; "><br></span></div></span></span><br class="Apple-interchange-newline">
</div>
<br></body></html>