Multiple Shibboleth Products CVE-2015-1796 Security Bypass Vulnerability

Bugtraq ID:	75370
Class:	Input Validation Error
CVE:	CVE-2015-1796
Remote:	Yes
Local:	No
Published:	Jun 23 2015 12:00AM
Updated:	Jun 23 2015 12:00AM
Credit:	Brent Putman, Shibboleth Project and Georgetown University
Vulnerable:	Shibboleth OpenSAML-Java 2.6.1 Shibboleth OpenSAML-Java 2.6 Shibboleth OpenSAML Java 2.6.4 Shibboleth Identity Provider 2.4.3 Redhat JBoss Fuse 6.1.0 Redhat JBoss A-MQ 6.1.0
Not Vulnerable:	Shibboleth OpenSAML Java 2.6.5 Shibboleth Identity Provider 2.4.4 Redhat JBoss Fuse 6.2 Redhat JBoss A-MQ 6.2

Multiple Shibboleth Products CVE-2015-1796 Security Bypass Vulnerability

Multiple Shibboleth Products are prone to a security-bypass vulnerability.

An attacker can leverage this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks.

The following products are vulnerable:

Versions prior to Shibboleth Identity Provider 2.4.4
Versions prior to Shibboleth OpenSAML Java 2.6.5

Multiple Shibboleth Products CVE-2015-1796 Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple Shibboleth Products CVE-2015-1796 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Shibboleth Products CVE-2015-1796 Security Bypass Vulnerability

References:

• Important: Red Hat JBoss A-MQ 6.2.0 update (Red Hat)
  
• CVE-2015-1796 OpenSAML Java: PKIX Trust Engines Exhibit Critical Flaw In Trusted (Bugzilla)
  
• Important: Red Hat JBoss Fuse 6.2.0 update (Red Hat)
  
• Shibboleth Security Advisory [ 25 February 2015 ] (Shibboleth)