Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.

This update for xmltooling fixes the following issues :

  - CVE-2018-0489: Fixed a security bug when xmltooling     mishandled digital signatures of user data, which allows     remote attackers to obtain sensitive information or     conduct impersonation attacks via crafted XML data.
    NOTE: this issue exists because of an incomplete fix for     CVE-2018-0486. (bsc#1083247)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xmltooling fixes the following issues :

  - CVE-2018-0489: Fixed a security bug when xmltooling     mishandled digital signatures of user data, which allows     remote attackers to obtain sensitive information or     conduct impersonation attacks via crafted XML data.
    NOTE: this issue exists because of an incomplete fix for     CVE-2018-0486. (bsc#1083247)

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for xmltooling fixes the following issues :

  - CVE-2018-0486: Fixed a security bug when xmltooling     mishandles digital signatures of user attribute data,     which allows remote attackers to obtain sensitive     information or conduct impersonation attacks via a     crafted DTD (bsc#1075975)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xmltooling fixes the following issues :

  - CVE-2018-0486: Fixed a security bug when xmltooling     mishandles digital signatures of user attribute data,     which allows remote attackers to obtain sensitive     information or conduct impersonation attacks via a     crafted DTD (bsc#1075975)

This update was imported from the SUSE:SLE-12-SP1:Update update project.

Shibboleth consortium reports :

Shibboleth SP software vulnerable to forged user attribute data

The Service Provider software relies on a generic XML parser to process SAML responses and there are limitations in older versions of the parser that make it impossible to fully disable Document Type Definition (DTD) processing.

Through addition/manipulation of a DTD, it's possible to make changes to an XML document that do not break a digital signature but are mishandled by the SP and its libraries. These manipulations can alter the user data passed through to applications behind the SP and result in impersonation attacks and exposure of protected information.

While newer versions of the xerces-c3 parser are configured by the SP into disallowing the use of a DTD via an environment variable, this feature is not present in the xerces-c3 parser before version 3.1.4, so an additional fix is being provided now that an actual DTD exploit has been identified. Xerces-c3-3.1.4 was committed to the ports tree already on 2016-07-26.

Philip Huppert discovered the Shibboleth service provider is vulnerable to impersonation attacks and information disclosure due to mishandling of DTDs in the XMLTooling XML parsing library. For additional details please refer to the upstream advisory at https://shibboleth.net/community/advisories/secadv_20180112.txt

Philip Huppert discovered the Shibboleth service provider is vulnerable to impersonation attacks and information disclosure due to mishandling of DTDs in the XMLTooling XML parsing library. For additional details please refer to the upstream advisory at

https://shibboleth.net/community/advisories/secadv_20180112.txt

For Debian 7 'Wheezy', these problems have been fixed in version 1.4.2-5+deb7u2.

We recommend that you upgrade your xmltooling packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
108451	SUSE SLES12 Security Update : xmltooling (SUSE-SU-2018:0720-1)	Nessus	SuSE Local Security Checks	medium
108440	openSUSE Security Update : xmltooling (openSUSE-2018-276)	Nessus	SuSE Local Security Checks	medium
107251	SUSE SLES12 Security Update : xmltooling (SUSE-SU-2018:0140-1)	Nessus	SuSE Local Security Checks	medium
106224	openSUSE Security Update : xmltooling (openSUSE-2018-65)	Nessus	SuSE Local Security Checks	medium
106036	FreeBSD : shibboleth-sp -- vulnerable to forged user attribute data (3dbe9492-f7b8-11e7-a12d-6cc21735f730)	Nessus	FreeBSD Local Security Checks	medium
105800	Debian DSA-4085-1 : xmltooling - security update	Nessus	Debian Local Security Checks	medium
105798	Debian DLA-1242-1 : xmltooling security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2018-0486

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium