[BSA-103] Security Update for shibboleth-sp

2015-04-1411:18:29

lists.debian.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

AI Score

6.6

Confidence

Low

EPSS

0.004

Percentile

74.2%

JSON

Matthew Vernon uploaded new packages for shibboleth-sp which fixed the
following security problems:

CVE-2015-2684
A denial of service vulnerability was found in the Shibboleth (a
federated identity framework) Service Provider. When processing
certain malformed SAML messages generated by an authenticated
attacker, the daemon could crash.

For the wheezy-backports distribution the problems have been fixed in
version 2.5.3+dfsg-2~bpo70+1.

OSVersionArchitecturePackageVersionFilename
Debian6i386libshibsp4< 2.3.1+dfsg-5+deb6u1libshibsp4_2.3.1+dfsg-5+deb6u1_i386.deb
Debian6i386libapache2-mod-shib2< 2.3.1+dfsg-5+deb6u1libapache2-mod-shib2_2.3.1+dfsg-5+deb6u1_i386.deb
Debian7kfreebsd-i386libshibsp-dev< 2.4.3+dfsg-5+deb7u1libshibsp-dev_2.4.3+dfsg-5+deb7u1_kfreebsd-i386.deb
Debian7powerpclibshibsp-dev< 2.4.3+dfsg-5+deb7u1libshibsp-dev_2.4.3+dfsg-5+deb7u1_powerpc.deb
Debian7powerpclibshibsp5< 2.4.3+dfsg-5+deb7u1libshibsp5_2.4.3+dfsg-5+deb7u1_powerpc.deb
Debian7alllibshibsp-doc< 2.4.3+dfsg-5+deb7u1libshibsp-doc_2.4.3+dfsg-5+deb7u1_all.deb
Debian6alllibshibsp-doc< 2.3.1+dfsg-5+deb6u1libshibsp-doc_2.3.1+dfsg-5+deb6u1_all.deb
Debian7armhflibapache2-mod-shib2< 2.4.3+dfsg-5+deb7u1libapache2-mod-shib2_2.4.3+dfsg-5+deb7u1_armhf.deb
Debian7s390xlibshibsp-dev< 2.4.3+dfsg-5+deb7u1libshibsp-dev_2.4.3+dfsg-5+deb7u1_s390x.deb
Debian7armellibshibsp-dev< 2.4.3+dfsg-5+deb7u1libshibsp-dev_2.4.3+dfsg-5+deb7u1_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	i386	libshibsp4	< 2.3.1+dfsg-5+deb6u1	libshibsp4_2.3.1+dfsg-5+deb6u1_i386.deb
Debian	6	i386	libapache2-mod-shib2	< 2.3.1+dfsg-5+deb6u1	libapache2-mod-shib2_2.3.1+dfsg-5+deb6u1_i386.deb
Debian	7	kfreebsd-i386	libshibsp-dev	< 2.4.3+dfsg-5+deb7u1	libshibsp-dev_2.4.3+dfsg-5+deb7u1_kfreebsd-i386.deb
Debian	7	powerpc	libshibsp-dev	< 2.4.3+dfsg-5+deb7u1	libshibsp-dev_2.4.3+dfsg-5+deb7u1_powerpc.deb
Debian	7	powerpc	libshibsp5	< 2.4.3+dfsg-5+deb7u1	libshibsp5_2.4.3+dfsg-5+deb7u1_powerpc.deb
Debian	7	all	libshibsp-doc	< 2.4.3+dfsg-5+deb7u1	libshibsp-doc_2.4.3+dfsg-5+deb7u1_all.deb
Debian	6	all	libshibsp-doc	< 2.3.1+dfsg-5+deb6u1	libshibsp-doc_2.3.1+dfsg-5+deb6u1_all.deb
Debian	7	armhf	libapache2-mod-shib2	< 2.4.3+dfsg-5+deb7u1	libapache2-mod-shib2_2.4.3+dfsg-5+deb7u1_armhf.deb
Debian	7	s390x	libshibsp-dev	< 2.4.3+dfsg-5+deb7u1	libshibsp-dev_2.4.3+dfsg-5+deb7u1_s390x.deb
Debian	7	armel	libshibsp-dev	< 2.4.3+dfsg-5+deb7u1	libshibsp-dev_2.4.3+dfsg-5+deb7u1_armel.deb