Shibboleth Identity Provider TransientID Mapping Information Disclosure Vulnerability
BID:45793
Info
Shibboleth Identity Provider TransientID Mapping Information Disclosure Vulnerability
| Bugtraq ID: | 45793 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 13 2011 12:00AM |
| Updated: | Jan 13 2011 12:00AM |
| Credit: | Robert Egglestone, Univ. of Auckland. |
| Vulnerable: |
Shibbolet Shibbolet 1.3.5 Shibbolet Shibbolet 2.2 Shibbolet Shibbolet 2.1 Shibbolet Shibbolet 2.0 Shibbolet Shibbolet 1.3 Shibbolet Shibbolet 1.2 Shibbolet Shibbolet 1.1 Shibbolet Shibbolet 1.0 |
| Not Vulnerable: |
Shibbolet Shibbolet 2.2.1 |
Discussion
Shibboleth Identity Provider TransientID Mapping Information Disclosure Vulnerability
Shibboleth is prone to an information-disclosure vulnerability.
Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.
Versions prior to Shibboleth 2.2.1 is vulnerable; other versions may also be affected,
Shibboleth is prone to an information-disclosure vulnerability.
Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.
Versions prior to Shibboleth 2.2.1 is vulnerable; other versions may also be affected,
Exploit / POC
Shibboleth Identity Provider TransientID Mapping Information Disclosure Vulnerability
An attacker can use readily available network utilities to exploit this issue.
An attacker can use readily available network utilities to exploit this issue.
Solution / Fix
Shibboleth Identity Provider TransientID Mapping Information Disclosure Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Shibboleth Identity Provider TransientID Mapping Information Disclosure Vulnerability
References:
References:
- hibboleth IdP 2.X Single TransientID Mapped to Multiple Principals (Shibboleth)
- Shibboleth Homepage (Chris Ries)