Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."

Backport of 2.4.3 patch which fixes CVE-2011-1411.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

IBM WebSphere Application Server 8.0 before Fix Pack 1 appears to be running on the remote host and is potentially affected by the following vulnerabilities :

  - An open redirect vulnerability exists related to the     'logoutExitPage' parameter. This can allow remote     attackers to trick users into requesting unintended     URLs. (PM35701)

  - The administrative console can display a stack trace     under unspecified circumstances and can disclose     potentially sensitive information to local users.
    (PM36620)

  - An unspecified error exists that can allow cross-site     request forgery attacks. (PM36734)

  - A token verification error exists in the bundled     OpenSAML library. This error can allow an attacker to     bypass security controls with an XML signature wrapping     attack via SOAP messages. (PM43254)

  - A directory traversal attack is possible via unspecified     parameters in the 'help' servlet. (PM45322)

  - The JavaServer Faces (JSF) application functionality     could allow a remote attacker to read files because it     fails to properly handle requests. (PM45992)

  - The HTTP server contains an error in the 'ByteRange'     filter and can allow denial of service attacks when     processing malicious requests. (PM46234)

IBM WebSphere Application Server 7.0 before Fix Pack 19 appears to be running on the remote host.  As such, it is potentially affected by the following vulnerabilities :

  - An open redirect vulnerability exists related to the     'logoutExitPage' parameter. This can allow remote     attackers to trick users into requesting unintended     URLs. (PM35701)

  - The administrative console can display a stack trace     under unspecified circumstances and can disclose     potentially sensitive information to local users.
    (PM36620)

  - The Installation Verification Tool servlet (IVT) does     not properly sanitize user-supplied input of arbitrary     HTML and script code, which could allow cross-site     scripting attacks. (PM40733)

  - A token verification error exists in the bundled     OpenSAML library. This error can allow an attacker to     bypass security controls with an XML signature wrapping     attack via SOAP messages. (PM43254)

  - A directory traversal attack is possible via unspecified     parameters in the 'help' servlet. (PM45322)

OpenSAML developer reports :

The Shibboleth software relies on the OpenSAML libraries to perform verification of signed XML messages such as attribute queries or SAML assertions. Both the Java and C++ versions are vulnerable to a so-called 'wrapping attack' that allows a remote, unauthenticated attacker to craft specially formed messages that can be successfully verified, but contain arbitrary content.

Juraj Somorovsky, Andreas Mayer, Meiko Jensen, Florian Kohlar, Marco Kampmann and Joerg Schwenk discovered that Shibboleth, a federated web single sign-on system is vulnerable to XML signature wrapping attacks.
More details can be found in the Shibboleth advisory.

ID	Name	Product	Family	Severity
56360	Fedora 16 : opensaml-2.3-6.fc16 (2011-12815)	Nessus	Fedora Local Security Checks	medium
56348	IBM WebSphere Application Server 8.0 < Fix Pack 1 Multiple Vulnerabilities	Nessus	Web Servers	high
56303	Fedora 15 : opensaml-2.3-4.fc15 (2011-12890)	Nessus	Fedora Local Security Checks	medium
56229	IBM WebSphere Application Server 7.0 < Fix Pack 19 Multiple Vulnerabilities	Nessus	Web Servers	medium
55681	FreeBSD : opensaml2 -- unauthenticated login (9f14cb36-b6fc-11e0-a044-445c73746d79)	Nessus	FreeBSD Local Security Checks	medium
55674	Debian DSA-2284-1 : opensaml2 - implementation error	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2011-1411

medium

Tenable Plugins

medium

high

medium

medium

medium

medium