Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 04 Nov 2014 12:53:43 +1100
From: Murray McAllister <mmcallis@...hat.com>
To: oss-security@...ts.openwall.com
CC: olav.morken@...nett.no
Subject: CVE-2014-8566 and CVE-2014-8567: mod_auth_mellon issues affecting
 users of 0.8.0

Good morning,

mod_auth_mellon provides a SAML 2.0 authentication module for the Apache 
HTTP Server.

The below issues were fixed in the 0.9.0 and
0.9.1 releases, but not marked as security issues at the time. (An 0.8.1 
security update has been released too, 
<https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.8.1>)

While Red Hat ship version 0.8.0, it is expected that very few others 
would have been using this version (if any).

 From 
<https://postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html>:

""
It turned out that session overflow bugs fixes in version 0.9.0 and
0.9.1 can lead to information disclosure, where data from one session
is leaked to another session. Depending on how this data is used by the
web application, this may lead to data from one session being disclosed
to an user in a different session. (CVE-2014-8566)

In addition to the information disclosure, this release contains some
fixes for logout processing, where logout requests would crash the
Apache web server. (CVE-2014-8567)
""

You may also come across 
<https://bugzilla.redhat.com/show_bug.cgi?id=1157955>. I originally 
thought 
<https://github.com/UNINETT/mod_auth_mellon/commit/47a767d5f37d1d3a1c004abbf8bb80d1b7eab328>/<http://jbp.io/2014/01/16/openssl-rand-api/#recommendations-and-patches> 
could lead to a predictable session cookie being returned, but it turns 
out that is not the case (and MITRE did not assign a CVE for this change).

Cheers,

--
Murray McAllister / Red Hat Product Security

https://bugzilla.redhat.com/show_bug.cgi?id=1157281
https://bugzilla.redhat.com/show_bug.cgi?id=1157954

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ