===================================================================== CERT-Renater Note d'Information No. 2009/VULN438 _____________________________________________________________________ DATE : 04/11/2009 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running Shibboleth Identity Provider versions 1.3.x, 2.x, Shibboleth Service Provider versions 1.3.x, 2.x. ====================================================================== http://shibboleth.internet2.edu/secadv/secadv_20091104.txt ______________________________________________________________________ Shibboleth Security Advisory [4 November 2009] Updated versions of the Shibboleth 1.3.x and 2.x Identity Provider and Service Provider software are available which correct a security issue. This general issue affects BOTH the Identity and Service Provider components, so a single advisory is being issued for both. Shibboleth software improperly handles malformed URLs ======================================================================= The Shibboleth software includes code to perform arbitrary redirections and generates forms containing arbitrary destinations in certain cases. The URLs used were not properly checked for certain kinds of cross-site scripting (XSS) attacks and are vulnerable to script injection and some related vulnerabilities. Identity Provider Vulnerability ------------------------------- Both the 1.3.x and 2.x Identity Provider software versions are vulnerable to script injection when supporting so-called "anonymous" relying parties. IdP 1.3.x has anonymous relying party support enabled by default. To disable it add the attribute 'allowAnonymousProviders="false"' to the element within the idp.xml configuration file. IdP 2.x has anonymous relying party support disabled by default. It has been enabled if there are elements within the element in the relying-party.xml configuration file. Remove the elements to disable it again. In normal use, the software enforces restrictions on the URLs it will use based on the SAML metadata it's given. If the software is configured to respond to requests without corresponding metadata, as described above, or if the source of metadata is insufficiently secure, it is vulnerable. Even if your configuration is not vulnerable, we do recommend that you perform the appropriate upgrade. Identity Provider Recommendations --------------------------------- Sites using 1.3.x should upgrade to the latest released version, 1.3.4, in the usual fashion. Sites using 2.x should upgrade to the latest released version, 2.1.5, per the normal upgrade process: https://spaces.internet2.edu/display/SHIB2/IdP2Upgrade Service Provider Vulnerability ------------------------------ Both the 1.3.x and 2.x Service Provider software versions are vulnerable to both script injection and some lower-level attacks when configured in typical fashion because of the number of arbitrary redirects supported throughout the feature set. It is unlikely that a typical deployment could be effectively configured to resist all possible sources of attack. Service Provider Recommendations -------------------------------- Sites using 1.3.x should upgrade to the latest released version, 1.3.5, in the usual fashion. Sites using 2.x should upgrade to the latest released version, 2.3, in the usual fashion. This requires upgrades to the dependent OpenSAML and XMLTooling libraries to versions 2.3 and 1.3 respectively. Sites using the Windows version of the software can obtain this fix from the updated and signed postinstall.zip packages available on the download site for the 2.3 and 1.3.5 SPs. Sites using non-Windows versions can update by building and installing the updated packages from source, or by RPM, Macport, or other applicable mechanism. For those using platforms unsupported by the project team directly, refer to your vendor or package source directly for information on obtaining the fixed version. Credits ------- Thanks to Matt Elder for reporting this issue. URL for this Security Advisory: http://shibboleth.internet2.edu/secadv/secadv_20091104.txt The Service Provider portion of this advisory has been assigned CVE-2009-3300 by the National Vulnerability Database. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3300 ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================