[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 04 Nov 2014 12:53:43 +1100
From: Murray McAllister <mmcallis@...hat.com>
To: oss-security@...ts.openwall.com
CC: olav.morken@...nett.no
Subject: CVE-2014-8566 and CVE-2014-8567: mod_auth_mellon issues affecting
users of 0.8.0
Good morning,
mod_auth_mellon provides a SAML 2.0 authentication module for the Apache
HTTP Server.
The below issues were fixed in the 0.9.0 and
0.9.1 releases, but not marked as security issues at the time. (An 0.8.1
security update has been released too,
<https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.8.1>)
While Red Hat ship version 0.8.0, it is expected that very few others
would have been using this version (if any).
From
<https://postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html>:
""
It turned out that session overflow bugs fixes in version 0.9.0 and
0.9.1 can lead to information disclosure, where data from one session
is leaked to another session. Depending on how this data is used by the
web application, this may lead to data from one session being disclosed
to an user in a different session. (CVE-2014-8566)
In addition to the information disclosure, this release contains some
fixes for logout processing, where logout requests would crash the
Apache web server. (CVE-2014-8567)
""
You may also come across
<https://bugzilla.redhat.com/show_bug.cgi?id=1157955>. I originally
thought
<https://github.com/UNINETT/mod_auth_mellon/commit/47a767d5f37d1d3a1c004abbf8bb80d1b7eab328>/<http://jbp.io/2014/01/16/openssl-rand-api/#recommendations-and-patches>
could lead to a predictable session cookie being returned, but it turns
out that is not the case (and MITRE did not assign a CVE for this change).
Cheers,
--
Murray McAllister / Red Hat Product Security
https://bugzilla.redhat.com/show_bug.cgi?id=1157281
https://bugzilla.redhat.com/show_bug.cgi?id=1157954
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
