This host is installed with Shibboleth and is prone to denial of service vulnerability.

Successful exploitation could allow remote attackers to cause the application to crash, resulting in denial-of-service conditions. Impact Level: Application

Upgrade to Shibboleth version 2.4.3 or later, For updates refer to http://shibboleth.internet2.edu/downloads.html

The flaw is due to off-by-one error in the XML signature feature in Apache XML Security, allows remote attackers to cause a denial of service via a signature using a large RSA key, which triggers a buffer overflow.

Shibboleth versions prior to 2.4.3

• http://secunia.com/advisories/45191
• http://shibboleth.internet2.edu/secadv/secadv_20110706.txt
• http://xforce.iss.net/xforce/xfdb/68420

---

Updated on 2015-03-25