shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka SSPCPP-763.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service     Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not     perform critical security checks such as signature verification, enforcement of validity periods, and     other checks specific to deployments, aka SSPCPP-763. (CVE-2017-16852)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for shibboleth-sp fixes the following issues :

Security issue fixed :

  - CVE-2017-16852: Fix critical security checks in the     Dynamic MetadataProvider plugin in Shibboleth Service     (bsc#1068689).

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for shibboleth-sp fixes the following issues: Security issue fixed :

  - CVE-2017-16852: Fix critical security checks in the     Dynamic MetadataProvider plugin in Shibboleth Service     (bsc#1068689).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Rod Widdowson of Steading System Software LLP discovered a coding error in the 'Dynamic' metadata plugin of the Shibboleth Service Provider, causing the plugin to fail configuring itself with the filters provided and omitting whatever checks they are intended to perform.

For Debian 7 'Wheezy', these problems have been fixed in version 2.4.3+dfsg-5+deb7u2.

We recommend that you upgrade your shibboleth-sp2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Rod Widdowson of Steading System Software LLP discovered a coding error in the 'Dynamic' metadata plugin of the Shibboleth Service Provider, causing the plugin to fail configuring itself with the filters provided and omitting whatever checks they are intended to perform.

See https://shibboleth.net/community/advisories/secadv_20171115.txt for details.

ID	Name	Product	Family	Severity
263400	Linux Distros Unpatched Vulnerability : CVE-2017-16852	Nessus	Misc.	high
105234	openSUSE Security Update : shibboleth-sp (openSUSE-2017-1348)	Nessus	SuSE Local Security Checks	high
105036	SUSE SLES12 Security Update : shibboleth-sp (SUSE-SU-2017:3215-1)	Nessus	SuSE Local Security Checks	high
104682	Debian DLA-1179-1 : shibboleth-sp2 security update	Nessus	Debian Local Security Checks	high
104644	Debian DSA-4038-1 : shibboleth-sp2 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-16852

high

Tenable Plugins

high

high

high

high

high