Stay Secure with the Latest Linux Advisories

security advisorycross-site scriptingUbuntu

Ubuntu: 4597-1 Critical: libapache2-mod-auth-mellon Session Attacks

Several security issues were fixed in mod_auth_mellon.. =========================================================================Ubuntu Security Notice USN-4597-1 October 22, 2020 libapache2-mod-auth-mellon vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: Several security issues were fixed in mod_auth_mellon. Software Description: - libapache2-mod-auth-mellon: SAML 2.0 authentication module for Apache Details: François Kooman discovered that mod_auth_mellon incorrectly handled cookies. An attacker could possibly use this issue to cause a Cross-Site Session Transfer attack. (CVE-2017-6807) It was discovered that mod_auth_mellon incorrectly handled certain requests. An attacker could possibly use this issue to redirect a user to a malicious URL. (CVE-2019-3877) It was discovered that mod_auth_mellon incorrectly handled certain requests. An attacker could possibly use this issue to access sensitive information. (CVE-2019-3878) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: libapache2-mod-auth-mellon 0.12.0-2+deb9u1build0.16.04.1 In general, a standard system update will make all the necessary changes. References: CVE-2017-6807, CVE-2019-3877, CVE-2019-3878 Package Information: https://launchpad.net/ubuntu/+source/libapache2-mod-auth-mellon/0.12.0-2+deb9u1build0.16.04.1 . Upgrade the libapache2-mod-auth-mellon packages to address severe security flaws impacting Ubuntu 16.04 LTS.. libapache2-mod-auth-mellon, security issues, session transfer, cross-site scripting. . Severity: Critical. LinuxSecurity.com Team

Oct 22, 2020 •Critical Ubuntu