Executive Summary
| Summary | |
|---|---|
| Title | ipsilon security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2016:2809 | First vendor Publication | 2016-11-21 |
| Vendor | RedHat | Last vendor Modification | 2016-11-21 |
| Severity (Vendor) | N/A | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.4 | Attack Range | Network |
| Cvss Impact Score | 4.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: An update for ipsilon is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server (v. 7) - noarch 3. Description: The ipsilon packages provide the Ipsilon identity provider service for federated single sign-on (SSO). Ipsilon links authentication providers and applications or utilities to allow for SSO. It includes a server and utilities to configure Apache-based service providers. Security Fix(es): * A vulnerability was found in ipsilon in the SAML2 provider's handling of sessions. An attacker able to hit the logout URL could determine what service providers other users are logged in to and terminate their sessions. (CVE-2016-8638) This issue was discovered by Patrick Uiterwijk (Red Hat) and Howard Johnson. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1392829 - CVE-2016-8638 ipsilon: DoS via logging out all open SAML2 sessions |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2016-2809.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-384 | Session Fixation |
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2018-01-19 | Name : The remote EulerOS host is missing a security update. File : EulerOS_SA-2018-1013.nasl - Type : ACT_GATHER_INFO |
| 2016-12-29 | Name : The remote Fedora host is missing a security update. File : fedora_2016-2d8fb6d7ad.nasl - Type : ACT_GATHER_INFO |
| 2016-12-29 | Name : The remote Fedora host is missing a security update. File : fedora_2016-b465090499.nasl - Type : ACT_GATHER_INFO |
| 2016-11-28 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2016-2809.nasl - Type : ACT_GATHER_INFO |
| 2016-11-22 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-2809.nasl - Type : ACT_GATHER_INFO |
| 2016-11-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-2809.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2018-01-05 09:26:25 |
|
| 2016-11-29 13:23:41 |
|
| 2016-11-23 13:25:43 |
|
| 2016-11-21 17:21:53 |
|
