[Backports-security-announce] Security Update for Shibboleth packages

Russ Allbery uploaded new packages for xmltooling, opensaml2, shibboleth-sp2, and shibboleth-sp which fixed the following security problems: CVE-2009-3300 The Shibboleth software includes code to perform arbitrary redirections and generates forms containing arbitrary destinations in certain cases...

[SECURITY] [DSA 1947-1] New Shibboleth packages fix cross-site scripting

------------------------------------------------------------------------ Debian Security Advisory DSA-1947-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 07, 2009 http://www.debian.org/security/faq -...

DSA-1947-1 opensaml2 shibboleth-sp shibboleth-sp2 - cross-site scripting

Bulletin has no description...

Shibboleth Service Provider Multiple XSS Vulnerabilities (Windows)

The host has Shibboleth Service Provider installed and is prone to multiple Cross-Site Scripting vulnerabilities. OpenVAS Vulnerability Test $Id: gbshibbolethspmultxssvulnwin.nasl 4869 2016-12-29 11:01:45Z teissa $ Shibboleth Service Provider Multiple XSS Vulnerabilities Windows Authors: Sharath ...

Shibboleth Service Provider Multiple XSS Vulnerabilities - Windows

Shibboleth Service Provider is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2009-3300

Multiple cross-site scripting XSS vulnerabilities in the Identity Provider IdP 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via...

CVE-2009-3300

Multiple cross-site scripting XSS vulnerabilities in the Identity Provider IdP 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via...

CVE-2009-3300

Multiple cross-site scripting XSS vulnerabilities in the Identity Provider IdP 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via...

DEBIAN-CVE-2009-3300

Multiple cross-site scripting XSS vulnerabilities in the Identity Provider IdP 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via...

CVE-2009-3300

The CVE-2009-3300 issue affects Shibboleth-related components: Identity Provider (IdP) and Service Provider (SP) in Shibboleth environments. Concrete details show multiple cross-site scripting (XSS) vulnerabilities that arise from redirect URLs appearing in automatically generated forms. Affected...

Debian Security Advisory DSA 1895-2 (opensaml2, shibboleth-sp2)

The remote host is missing an update to opensaml2, shibboleth-sp2 announced via advisory DSA 1895-2. OpenVAS Vulnerability Test $Id: deb18952.nasl 6615 2017-07-07 12:09:52Z cfischer $ Description: Auto-generated from advisory DSA 1895-2 opensaml2, shibboleth-sp2 Authors: Thomas Reinke Copyright:...

Debian: Security Advisory (DSA-1895-2)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Shibboleth Service Provider Version Detection

This script detects the installed version of Shibboleth Service Provider and sets the result in KB. OpenVAS Vulnerability Test $Id: gbshibbolethspdetectwin.nasl 5372 2017-02-20 16:26:11Z cfi $ Shibboleth Service Provider Version Detection Authors: Sharath S Copyright: Copyright c 2009 Greenbone...

Shibboleth Service Provider NULL Character Spoofing Vulnerability - Windows

Shibboleth Service Provider is prone to a NULL character spoofing vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Shibboleth Service Provider Version Detection

This script detects the installed version of Shibboleth Service Provider. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SA-CONTRIB-2009-070 - Shibboleth authentication - Impersonation, privilege escalation

The Shibboleth authentication module provides user authentication and authorisation based on the Shibboleth Web Single Sign-on system. The module does not properly handle the changes of the underlying Shibboleth session. This can result in impersonation and possible privilege escalation if a user...

DSA-1895-2 opensaml2, shibboleth-sp2 - interpretation conflict

Bulletin has no description...

Debian Security Advisory DSA 1896-1 (opensaml, shibboleth-sp)

The remote host is missing an update to opensaml, shibboleth-sp announced via advisory DSA 1896-1. OpenVAS Vulnerability Test $Id: deb18961.nasl 6615 2017-07-07 12:09:52Z cfischer $ Description: Auto-generated from advisory DSA 1896-1 opensaml, shibboleth-sp Authors: Thomas Reinke Copyright:...

Debian: Security Advisory (DSA-1896-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2009-3476

Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute...