Vulnerability CVE-2018-0486
Published: 2018-01-13

Description:
Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Shibboleth 2 XML Injection
RedTeam
15.01.2018

Type:

CWE-347

 (Improper Verification of Cryptographic Signature)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.4/10
4.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
None
Affected software
Debian -> Debian linux 

 References:
http://www.securitytracker.com/id/1040177
https://lists.debian.org/debian-lts-announce/2018/01/msg00016.html
https://lists.debian.org/debian-security-announce/2018/msg00007.html
https://shibboleth.net/community/advisories/secadv_20180112.txt
https://www.debian.org/security/2018/dsa-4085
Copyright 2024, cxsecurity.com

 

Back to Top