Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.0070
Shibboleth SP software crashes on malformed IdP History Cookie
11 January 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Shibboleth Service Provider
Publisher: Shibboleth
Operating System: UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Denial of Service -- Unknown/Unspecified
Resolution: Patch/Upgrade
Original Bulletin:
http://shibboleth.net/community/advisories/secadv_20130110.txt
- --------------------------BEGIN INCLUDED TEXT--------------------
Shibboleth Service Provider Security Advisory [10 January 2013]
An updated version of the Shibboleth Project's OpenSAML software in
C++ is available which corrects a security issue.
Shibboleth SP software crashes on malformed IdP History Cookie
====================================================================
The Service Provider software supports an option, disabled by
default, for tracking the history of Identity Providers used by a
client. A particular malformation of this cookie can cause the shibd
process to crash while appending the latest value to it, resulting in
a denial of service.
An updated version of OpenSAML-C, V2.5.2, is available that corrects
this bug. The bug is not present in versions of the library prior to
V2.5.0, so older versions of the Service Provider, such as V2.4.3,
are unlikely to be affected unless rebuilt against newer libraries.
Note that while the Embedded Discovery Service product we offer also
uses a cookie compatible with this feature, the use of a cookie by it
is not dependent on this feature within the SP, and does not cause
this problem to manifest, nor is its cookie functionality limited by
disabling (or more likely leaving disabled) this feature within the
SP software.
Recommendations
===============
Where possible, upgrade to V2.5.2 or later of the OpenSAML-C library.
In the interim, you can verify that the "idpHistory" option (found
in the shibboleth2.xml <Sessions> element) is unset or false, which
disables the use of this cookie. This is the default setting, so
unless you enabled it, or applied configuration examples that do so,
your system should not be affected.
Linux installations relying on official RPM packages can upgrade to
the latest opensaml package version to obtain the fix. An updated
Macport is also available.
Windows systems can apply a patch package [1] containing the fixed
library. New installs of the SP software (V2.5.1 or newer)
will contain the fix (you can verify after installation that your
logs indicate the expected OpenSAML version is used).
Credits
=======
Thanks to Dan McLaughlin for reporting this issue and assisting with
diagnosis and verifying the fix.
[1] http://shibboleth.net/downloads/service-provider/2.5.1/patches/
URL for this Security Advisory:
http://shibboleth.net/community/advisories/secadv_20130110.txt
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUO+Ine4yVqjM2NGpAQJjZw//fQcccI1RphWGtTpPCXV/VB20/KdVWp+P
WFKDdk7r3aEMKGlHZLiL0ANthugcg/T2vhJp6ivcAZjNiMR3tz4rlCY78aaDggAA
34iTMzo2V1mClJAJxc5GlL7IXgSPw+y95I72xvn4RQNQd1jGiZM+a6h4rcDkLUSB
tZ+sLcdhG3glwJVV9IifHzSahF8jKNIX08DA/xwd0Da3da7q7aa6hGPKXxAmE4eB
xFTLZBlI/K30tbY1BO42gjR+mVyExNVL95nastJc5vYGtgefJUDUYfkKAvKTN67k
Cx+yU/9r1SWjOJRNF4Pkh8j0tOOcGNVsy6OBi3siiOgzf+IBERRjciT6CqxSX3Xe
boXfJz2NUaCTMAgZOvXTYhi1LKjY/FLFDZRV/YbpVsmuq/tOH/SLwyQtGBXcOFPB
VI1CH/X+ePTtQAgq8VxkKrP5I7eIX/b/cTbVkgglE6wvC/E825rfpqDtRw29QOlS
7SI77ZtIjj2eYP3PchIplm2YAvCDjllExe8vscDr9XnupMNu7Nt4KN2DjJtGZ9Ig
I22qIrbQLYj3QTRh7rf8Snm8wLQqAVkp5OWvvT+pXngGQUW1meS+4mzYRgNzhoDt
YTgNGD2+inLovk1niWWw0IY65yV6Yfmn9ppX5jIgj0t2BnUHUEVdmAwur3mMjQIO
3qECW5vcNbQ=
=yGBi
-----END PGP SIGNATURE-----