Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: SANS Daily Network Security Podcast (Stormcast) for Wednesday, September 22nd, 2021 SANS Daily Network Security Podcast (Stormcast) for Wednesday, September 22nd, 2021


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

iOS 15 Private Relay; macOS Finder Vuln; vCenter Advisory; NetGear Circle Parental Control Vuln;

SANS Daily Network Security Podcast (Stormcast) for Wednesday, September 22nd, 2021
00:00

My Next Class

Intrusion Detection In-DepthOnlineOct 11th - Oct 16th 2021
Intrusion Detection In-DepthOnline | British Summer TimeOct 11th - Oct 16th 2021

… more classes

Spotify spotify logo

Discussion

The Shibboleth vulnerability is quite interesting. In their example, the SAML signature covers the entire and they've made modifications to it (the changes to the uid) that should cause the signature to fail validation. This vulnerability speaks to larger architectural issues with Shibboleth. Obviously the signature validation is happening on a DIFFERENT document (the inline DTD defs are resolved and replaced) than the attribute extraction code works on (the inline DTD variables are not replaced). This is a HUGE no no and leads to the confused deputy issues that caused the vulnerability. I would bet other SP SAML parsing code is making similar mistakes.
Posted by Anonymous on Tue Jan 16 2018, 16:54

Login here to join the discussion.

Intrusion Detection In-DepthOnlineOct 11th - Oct 16th 2021
Intrusion Detection In-DepthOnline | British Summer TimeOct 11th - Oct 16th 2021