ALERT: Update Shibboleth SP software for critical vulnerability

There is a critical vulnerability in the Shibboleth Service Provider (SP) software that, if exploited, could allow an attacker to cause Shibboleth to crash through a denial-of-service attack. Shibboleth is widely used at U-M and at research and education communities worldwide for logging in to websites and web-based applications.

There is a critical denial-of-service vulnerability in the Shibboleth Service Provider software that could allow an attacker to cause Shibboleth to crash. Upgrade to the latest version as soon as possible after appropriate testing to fix this.

If exploited, the vulnerability could be used by an attacker to cause Shibboleth SPs to crash through a denial-of-service attack. We believe that attackers could easily exploit this vulnerability to cause significant service outages.

Information Assurance (IA) recommends that you upgrade Shibboleth SPs to the latest version as soon as possible after appropriate testing. The Shibboleth Project has provided these recommendations:

• Update to V3.0.4 or later of the XMLTooling library, which is now available.
• The updated version of the library has been included in a V3.0.4 patch release of the Service Provider software on Windows.

See the Shibboleth site for downloads and release notes:

• Shibboleth Open SAML downloads
• Shibboleth V3.0.4 downloads
• Shibboleth V3.0.4 Release Notes

If your Shibboleth SP uses SAML software that is provided by a vendor:

• Understand your vendor's vulnerability disclosure process.
• Subscribe to the appropriate communication channels to be notified of vendor updates.
• Run a supported, up-to-date version of the software.

Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type. This generally manifests as a crash in the calling code, which in the Service Provider software's case is usually the shibd daemon process, but can be Apache in some cases. Note that the crash occurs prior to evaluation of a message's authenticity, so it can be exploited by an attacker.

This communication is being sent to those across the university who maintain and contract for machines running Shibboleth SP software, including those within Information and Technology Services (ITS). IA staff members are available to consult and assist with the needed upgrade as needed. Contact the ITS Service Center.

This particular Shibboleth vulnerability was identified by IA. While doing a penetration test that a U-M unit had requested, an IA staff member noticed that the Shibboleth SP on the machine being tested had stopped working. Through further testing, he confirmed a denial-of-service vulnerability. He then built the Shibboleth SP application from source code on an ITS server, debugged it, identified the problem, and figured out how to fix it. IA then provided full details to the Shibboleth Consortium so that a patch could be prepared and released.

Shibboleth is federated identity management software used to provide single sign-on. It allows members of the university community to log in to university-provided cloud services, such as U-M Google and U-M Box, using their uniqname and UMICH (Level-1) password. Users do not need to do anything related to this vulnerability. Shibboleth SP software needs to be updated by system administrators.

Questions about upgrading Shibboleth SP software can be directed to the ITS Service Center.