Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 515
Alerts This Week
Warning Icon 1 515

Red Hat 7: RHSA-2016:2809-01 Important: Ipsilon DoS Session Issue

red hat
Calendar Grey November 21, 2016
Scroller Redhat
A vital patch for pascal on CentOS 7 tackles vulnerabilities related to authorization management.
An update for ipsilon is now available for Red Hat Enterprise Linux 7

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

The ipsilon packages provide the Ipsilon identity provider service for federated single sign-on (SSO). Ipsilon links authentication providers and applications or utilities to allow for SSO. It includes a server and utilities to configure Apache-based service providers.
Security Fix(es):
* A vulnerability was found in ipsilon in the SAML2 provider's handling of sessions. An attacker able to hit the logout URL could determine what service providers other users are logged in to and terminate their sessions. (CVE-2016-8638)
This issue was discovered by Patrick Uiterwijk (Red Hat) and Howard Johnson.

Topics%20covered

Topics Covered

security advisory red hat important dos session issue ipsilon

References

https://access.redhat.com/security/cve/CVE-2016-8638 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux Server (v. 7):
Source: ipsilon-1.0.0-13.el7_3.src.rpm
noarch: ipsilon-1.0.0-13.el7_3.noarch.rpm ipsilon-authform-1.0.0-13.el7_3.noarch.rpm ipsilon-authgssapi-1.0.0-13.el7_3.noarch.rpm ipsilon-authldap-1.0.0-13.el7_3.noarch.rpm ipsilon-base-1.0.0-13.el7_3.noarch.rpm ipsilon-client-1.0.0-13.el7_3.noarch.rpm ipsilon-filesystem-1.0.0-13.el7_3.noarch.rpm ipsilon-infosssd-1.0.0-13.el7_3.noarch.rpm ipsilon-persona-1.0.0-13.el7_3.noarch.rpm ipsilon-saml2-1.0.0-13.el7_3.noarch.rpm ipsilon-saml2-base-1.0.0-13.el7_3.noarch.rpm ipsilon-tools-ipa-1.0.0-13.el7_3.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2016:2809-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2016:2809.html
Issue date: 2016-11-21

Topic

An update for ipsilon is now available for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory red hat important dos session issue ipsilon

Relevant Releases Architectures

Red Hat Enterprise Linux Server (v. 7) - noarch

Bugs Fixed

1392829 - CVE-2016-8638 ipsilon: DoS via logging out all open SAML2 sessions

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.