Bug 1534647 (CVE-2018-0486) - CVE-2018-0486 xmltooling: impersonation attack and sensitive information disclosure in the Service Provider via crafted DTD
Summary: CVE-2018-0486 xmltooling: impersonation attack and sensitive information disc...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2018-0486
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1534648
Blocks: 1534662
TreeView+ depends on / blocked
 
Reported: 2018-01-15 16:39 UTC by Laura Pardo
Modified: 2019-09-29 14:29 UTC (History)
45 users (show)

Fixed In Version: XMLTooling 1.6.3
Clone Of:
Environment:
Last Closed: 2018-02-14 19:35:17 UTC
Embargoed:

Attachments (Terms of Use)

Description Laura Pardo 2018-01-15 16:39:18 UTC 
A flaw was found in Shibboleth XMLTooling-C. Versions before 1.6.3 mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.

The Service Provider software relies on a generic XML parser to process SAML responses and there are limitations in older versions of the parser that make it impossible to fully disable Document Type Definition (DTD) processing. Through addition/manipulation of a DTD, it's possible to make changes to an XML document that do not break a digital signature but are mishandled by the SP and its libraries. These manipulations can alter the user data passed through to applications behind the SP and result in impersonation attacks and exposure of protected information.

References: 
http://shibboleth.net/community/advisories/secadv_20180112.txt
https://issues.shibboleth.net/jira/browse/CPPXT-127
Comment 1 Laura Pardo 2018-01-15 16:40:55 UTC 
Created xmltooling tracking bugs for this issue:

Affects: fedora-all [bug 1534648]
Comment 2 Jason Shepherd 2018-01-17 07:20:39 UTC 
Only C++ versions of xmltooling are affected, not Java. Marking JON as not affected.
Comment 3 Hooman Broujerdi 2018-01-17 22:48:35 UTC 
For the same reason Fuse is not affected either.
Comment 4 Jason Shepherd 2018-02-14 07:34:21 UTC 
Chess: Can you check JPP and JDG?
Comment 5 Chess Hazlett 2018-02-14 19:33:24 UTC 
JDG ships java version. Notaffected. JPP does not appear to ship, but would be a WONTFIX anyway.
Comment 6 Chess Hazlett 2018-02-14 19:34:41 UTC 
Closing flaw. Nothing to do.
Note You need to log in before you can comment on or make changes to this bug.