CVE-2018-0489
First published: Tue Feb 27 2018(Updated: )
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.
Credit: security@debian.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/xmltooling | 3.0.4-1+deb10u1 3.0.4-1+deb10u2 3.2.0-3+deb11u1 3.2.3-1+deb12u1 3.2.4-2 | |
| Shibboleth XMLTooling-C | <1.6.4 | |
| Debian Debian Linux | =7.0 | |
| Debian Debian Linux | =8.0 | |
| Debian Debian Linux | =9.0 | |
| Arubanetworks Clearpass | >=6.6.0<=6.6.9 | |
| Arubanetworks Clearpass | >=6.7.0<6.7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://shibboleth.net/community/advisories/secadv_20180227.txt
- https://issues.shibboleth.net/jira/browse/CPPXT-128
- https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations
- https://www.kb.cert.org/vuls/id/475445
- https://security-tracker.debian.org/tracker/CVE-2018-0489
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt
- http://www.securityfocus.com/bid/103172
- http://www.securitytracker.com/id/1040435
- https://lists.debian.org/debian-lts-announce/2018/02/msg00031.html
- https://www.debian.org/security/2018/dsa-4126
Frequently Asked Questions
What is the vulnerability ID for this Shibboleth XMLTooling-C vulnerability?
The vulnerability ID for this Shibboleth XMLTooling-C vulnerability is CVE-2018-0489.
What is the severity of CVE-2018-0489?
The severity of CVE-2018-0489 is medium.
How does this vulnerability affect Shibboleth Service Provider?
This vulnerability affects Shibboleth Service Provider before 2.6.1.4 on Windows and other products.
How can this vulnerability be exploited?
This vulnerability can be exploited by remote attackers using crafted XML data to obtain sensitive information or conduct impersonation attacks.
Are there any remediation steps available for this vulnerability?
Yes, remediation steps are available. Please refer to the provided references for more information.
- collector/security-tracker-debian
- collector/nvd-index
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/description
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/remedy
- agent/tags
- collector/mitre-cve
- source/MITRE
- package-manager/debian
- vendor/shibboleth
- canonical/shibboleth xmltooling-c
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/7.0
- version/debian debian linux/8.0
- version/debian debian linux/9.0
- vendor/arubanetworks
- canonical/arubanetworks clearpass
- version/arubanetworks clearpass/6.6.0
- version/arubanetworks clearpass/6.6.9
- version/arubanetworks clearpass/6.7.0