Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2014.1400
Shibboleth Identity Provider Security Advisory [13 August 2014]
15 August 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Shibboleth Identity Provider
Publisher: Shibboleth
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Access Privileged Data -- Remote with User Interaction
Provide Misleading Information -- Remote with User Interaction
Resolution: Patch/Upgrade
Original Bulletin:
http://shibboleth.net/community/advisories/secadv_20140813.txt
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Shibboleth Identity Provider Security Advisory [13 August 2014]
HTTPS Connections Via HTTP Resources Do Not Perform Hostname Verification
=========================================================================
The HttpResource and FileBackedHttpResource implementations in OpenSAML
and the IdP make use of the Jakarta Commons HttpClient version 3.x. When
used with an HTTPS scheme, HttpClient by default does not perform
verification of the server hostname against the server's X.509 certificate.
The lack of hostname verification means that while the connection between
the client and HTTPS server is encrypted, the client has no way to verify
it's actually communicating with the appropriate HTTPS server hosting the
resource data.
In the IdP, HttpResource and FileBackedHttpResource might commonly be used
within service.xml to enable fetching of remote configuration resources
for services from an HTTP server. They might less commonly be used in
relying-party.xml in conjunction with a ResourceBackedMetadataProvider.
Affected Versions
=================
Versions of the Identity Provider < 2.4.1
Versions of OpenSAML Java < 2.6.2
Recommendations
===============
IdP users: Upgrade to IdP 2.4.1 or greater, which globally configures
an appropriate hostname verifier for use with HttpClient. If this is
not feasible, and the only use of these resource types is with a
ResourceBackedMetadataProvider, then consider replacing the latter
with either a HTTPMetadataProvider or FileBackedHTTPMetadataProvider.
OpenSAML users: Upgrade to OpenSAML Java 2.6.2 or greater, which
globally configures an appropriate hostname verifier for use with
HttpClient. If this is not feasible, it is also possible to replicate
in your own code the registration of the appropriate hostname-verifying
socket factory added in 2.6.2. See the HttpClient 3.x web site,
or contact the Shibboleth developer list for details.
Note that in IdP v2.4.0 and above, use of the HTTP metadata provider
configuration option 'disregardSslCertificate' will globally disable
HttpClient hostname verification as well as TLS certificate trust
evaluation. This would include the HttpResource hostname verification
being added in the 2.4.1 release. This is a limitation caused by API
issues with HttpClient 3.x, and will be addressed in the 3.x version
of the Identity Provider. See the following related security advisory:
http://shibboleth.net/community/advisories/secadv_20130417.txt
Credits
=======
Kaspar Brand, SWITCH
URL for this Security Advisory
http://shibboleth.net/community/advisories/secadv_20140813.txt
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJT67VMAAoJEDeLhFQCJ3liPnEQALQMl0eCGD+5gUOpGf1MGrmC
BiWrwDrLuns4+5EzN5nvZc0iydJL46ZiBtvptGt9/QGgZB+uzx8RcuiN/juHzTr7
fgliqreVyJIqu+X0x63+B1fTT3QNxz4Vj8vqj8f8RiOSUX/BDn6sBUVIthkH85eK
XnOZOFpnqb6ziuu49vApt3mkwcJsaOQTaYpR9d7vk5LRT4auUI44m4Db37ARtTWm
0j/IUwLJnTPxLXn/HdG+yWHXRTaGUCdVhKggBPa47Wel6z5mdiKSpJn2F5t2GSNo
Q/BERC24kDyuebzzS5oNdpPmBE3QL7Nl/fHU7k/vZ+75nZwkpuhpgNonTO4PrkBl
W1h2sDUqKnxYvy9Y/58lTtDK0C+VcIn1he6bpUwG+DBCVBvicHR1yUuDktBsRNRb
78sRZpeAMoNVHfEe8+I/8RAlIr9gmuGh2nAR45DjOsDLIb/u4cAodN2sz7pijKzB
HtMgNuDN0J4F32HD77R2MjxTUvg2cAvjLstFm8RNg4WbCIZRBn39kNswG6pLfFxh
98Ki848uGSCSFBdISQF7mR5bXfgPFhdFnezwkuH34D/50etdwKex6dkgi0mYB8bN
MDQU3oYOjZ4ZkRlCivHBmYKLjmwdon5zQLQ+FMwBxxJCXE97xWEm+XIypC9bMzaX
fgARGn/wdTpelE7OiMlJ
=20Eq
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBU+1xxxLndAQH1ShLAQK1CQ/9F6IJosWvnX0AFdRzGEsnL1fvORv5hT4X
9RJ8Q7Vh87TMih452nvdKaoqHBjrcegjlZ/m/e6s5tsopFw3NmzGf6omQlTfxdC9
19IaVD6cSY31rggPiFflWPUsJTudLmnOuE+z4bCW6U7GVSebi/GXY2ze0e69YC8t
ZRewDcvMfoQkWdMdcr0pSzKwG99Bs0cj5KTSUnUoKSWocmrbW4sUtW1TAU8CO+gJ
tTuZRtHYNa736AzZTtLebW/QelnmACKasB1BzA/HKd33G37HMa29bZxON514Myed
NknLppYNXiAyzAvM1WFATZDajqptblrufx/FF9eGe3s1EAbHnIuVi+pjELnQHEoc
9OaWnaqC9FpH9BWMdyZCNGXQcTmKQBNRtFouLkz+xUgc/lxuMYGbh1xr0I+c1X0P
GqZqgNf68L8yUDQ+9laWT5Y3J05qz3DZfjGHdYUGrknNGqDoCyY0FRwNTQ3YyRnc
0Scu5cMgzqb0QuPvGNPTaPKAcE00vxhmb6NUKPik2fTS8OYfrwVcT4MdT8ddTCs6
kN8d8Yysi+iPOOaq+U3OzGE+JguqR8iM6k9o7ukGI/HezIIthkqiGsnpc/B/XBH8
ipkBJxMRjnswz8WtdZusib017BjzdsGUifKw7IuFOtuo8kFGsB0u/Ni7NVWRzlzd
wvf9hWXlaXM=
=ybre
-----END PGP SIGNATURE-----