Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: SANS Daily Network Security Podcast (Stormcast) for Monday, October 14th 2019 - SANS Internet Storm Center SANS Daily Network Security Podcast (Stormcast) for Monday, October 14th 2019


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

YARA Update; Hacking Back Against Ransomware; Fake Crypto Trading Software

previous
SANS Daily Network Security Podcast (Stormcast) for Monday, October 14th 2019
00:00

My Next Class

Intrusion Detection In-DepthSanta MonicaOct 21st - Oct 26th 2019
Defending Web Applications Security EssentialsSan FranciscoDec 2nd - Dec 7th 2019

… more classes

Spotify spotify logo

Discussion

The Shibboleth vulnerability is quite interesting. In their example, the SAML signature covers the entire and they've made modifications to it (the changes to the uid) that should cause the signature to fail validation. This vulnerability speaks to larger architectural issues with Shibboleth. Obviously the signature validation is happening on a DIFFERENT document (the inline DTD defs are resolved and replaced) than the attribute extraction code works on (the inline DTD variables are not replaced). This is a HUGE no no and leads to the confused deputy issues that caused the vulnerability. I would bet other SP SAML parsing code is making similar mistakes.
Posted by Anonymous on Tue Jan 16 2018, 16:54

Login here to join the discussion.

Top of page
Intrusion Detection In-DepthSanta MonicaOct 21st - Oct 26th 2019
Defending Web Applications Security EssentialsSan FranciscoDec 2nd - Dec 7th 2019
Defending Web Applications Security EssentialsSan FranciscoMar 16th - Mar 21st 2020
Defending Web Applications Security EssentialsAmsterdamMay 11th - May 16th 2020
Intrusion Detection In-DepthLas VegasJun 8th - Jun 13th 2020