Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2009.1480
Shibboleth 1.3.x and 2.x Identity Provider and Service
Provider software updated
5 November 2009
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Shibboleth 1.3.x
Shibboleth 2.x
Shibboleth Identity Provider
Shibboleth Service Provider
Publisher: The Shibboleth Team
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Cross-site Scripting -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2009-3300
Original Bulletin:
http://shibboleth.internet2.edu/secadv/secadv_20091104.txt
- --------------------------BEGIN INCLUDED TEXT--------------------
Shibboleth Security Advisory [4 November 2009]
Updated versions of the Shibboleth 1.3.x and 2.x Identity Provider and
Service Provider software are available which correct a security issue.
This general issue affects BOTH the Identity and Service Provider
components, so a single advisory is being issued for both.
Shibboleth software improperly handles malformed URLs
=======================================================================
The Shibboleth software includes code to perform arbitrary redirections
and generates forms containing arbitrary destinations in certain cases.
The URLs used were not properly checked for certain kinds of cross-site
scripting (XSS) attacks and are vulnerable to script injection and some
related vulnerabilities.
Identity Provider Vulnerability
- -------------------------------
Both the 1.3.x and 2.x Identity Provider software versions are
vulnerable to script injection when supporting so-called "anonymous"
relying parties.
IdP 1.3.x has anonymous relying party support enabled by default. To
disable it add the attribute 'allowAnonymousProviders="false"' to the
<IdPConfig> element within the idp.xml configuration file.
IdP 2.x has anonymous relying party support disabled by default. It
has been enabled if there are <ProfileConfiguration> elements within
the <AnonymousRelyingParty> element in the relying-party.xml
configuration file. Remove the <ProfileConfiguration> elements to
disable it again.
In normal use, the software enforces restrictions on the URLs it will
use based on the SAML metadata it's given. If the software is configured
to respond to requests without corresponding metadata, as described
above, or if the source of metadata is insufficiently secure, it is
vulnerable.
Even if your configuration is not vulnerable, we do recommend that you
perform the appropriate upgrade.
Identity Provider Recommendations
- ---------------------------------
Sites using 1.3.x should upgrade to the latest released version,
1.3.4, in the usual fashion.
Sites using 2.x should upgrade to the latest released version,
2.1.5, per the normal upgrade process:
https://spaces.internet2.edu/display/SHIB2/IdP2Upgrade
Service Provider Vulnerability
- ------------------------------
Both the 1.3.x and 2.x Service Provider software versions
are vulnerable to both script injection and some lower-level
attacks when configured in typical fashion because of the
number of arbitrary redirects supported throughout the
feature set. It is unlikely that a typical deployment could
be effectively configured to resist all possible sources of
attack.
Service Provider Recommendations
- --------------------------------
Sites using 1.3.x should upgrade to the latest released version,
1.3.5, in the usual fashion.
Sites using 2.x should upgrade to the latest released version,
2.3, in the usual fashion. This requires upgrades to the dependent
OpenSAML and XMLTooling libraries to versions 2.3 and 1.3 respectively.
Sites using the Windows version of the software can obtain this
fix from the updated and signed postinstall.zip packages available
on the download site for the 2.3 and 1.3.5 SPs.
Sites using non-Windows versions can update by building and installing
the updated packages from source, or by RPM, Macport, or other
applicable mechanism.
For those using platforms unsupported by the project team directly,
refer to your vendor or package source directly for information on
obtaining the fixed version.
Credits
- -------
Thanks to Matt Elder for reporting this issue.
URL for this Security Advisory:
http://shibboleth.internet2.edu/secadv/secadv_20091104.txt
The Service Provider portion of this advisory has been
assigned CVE-2009-3300 by the National Vulnerability Database.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3300
- --
SWITCH
Serving Swiss Universities
- --------------------------
Chad La Joie, Software Engineer, Net Services
Werdstrasse 2, P.O. Box, 8021 Zürich, Switzerland
phone +41 44 268 15 75, fax +41 44 268 15 68
chad.lajoie@switch.ch, http://www.switch.ch
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iD8DBQFK8hp7NVH5XJJInbgRAhfAAKCGIO6/8E1g+7BmMEB2iKK54/kHGgCdHzvZ
bu0YrwZGFD5F1gwubr6jAkI=
=nyQZ
-----END PGP SIGNATURE-----