Red Hat: 2014:1803-01: mod_auth_mellon: Important Advisory
Summary
mod_auth_mellon provides a SAML 2.0 authentication module for the Apache
HTTP Server.
An information disclosure flaw was found in mod_auth_mellon's session
handling that could lead to sessions overlapping in memory. A remote
attacker could potentially use this flaw to obtain data from another user's
session. (CVE-2014-8566)
It was found that uninitialized data could be read when processing a user's
logout request. By attempting to log out, a user could possibly cause the
Apache HTTP Server to crash. (CVE-2014-8567)
Red Hat would like to thank the mod_auth_mellon team for reporting these
issues. Upstream acknowledges Matthew Slowe as the original reporter of
CVE-2014-8566.
All users of mod_auth_mellon are advised to upgrade to this updated
package, which contains a backported patch to correct these issues.
Summary
Solution
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
References
https://access.redhat.com/security/cve/CVE-2014-8566 https://access.redhat.com/security/cve/CVE-2014-8567 https://access.redhat.com/security/updates/classification/#important
Package List
Red Hat Enterprise Linux Server (v. 6):
Source:
mod_auth_mellon-0.8.0-3.el6_6.src.rpm
i386:
mod_auth_mellon-0.8.0-3.el6_6.i686.rpm
mod_auth_mellon-debuginfo-0.8.0-3.el6_6.i686.rpm
ppc64:
mod_auth_mellon-0.8.0-3.el6_6.ppc64.rpm
mod_auth_mellon-debuginfo-0.8.0-3.el6_6.ppc64.rpm
s390x:
mod_auth_mellon-0.8.0-3.el6_6.s390x.rpm
mod_auth_mellon-debuginfo-0.8.0-3.el6_6.s390x.rpm
x86_64:
mod_auth_mellon-0.8.0-3.el6_6.x86_64.rpm
mod_auth_mellon-debuginfo-0.8.0-3.el6_6.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source:
mod_auth_mellon-0.8.0-3.el6_6.src.rpm
i386:
mod_auth_mellon-0.8.0-3.el6_6.i686.rpm
mod_auth_mellon-debuginfo-0.8.0-3.el6_6.i686.rpm
x86_64:
mod_auth_mellon-0.8.0-3.el6_6.x86_64.rpm
mod_auth_mellon-debuginfo-0.8.0-3.el6_6.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
Topic
An updated mod_auth_mellon package that fixes two security issues is nowavailable for Red Hat Enterprise Linux 6.Red Hat Product Security has rated this update as having Important securityimpact. Common Vulnerability Scoring System (CVSS) base scores, which givedetailed severity ratings, are available for each vulnerability from theCVE links in the References section.
Topic
Relevant Releases Architectures
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Bugs Fixed
1157281 - CVE-2014-8566 mod_auth_mellon: remote memory disclosure flaw
1157954 - CVE-2014-8567 mod_auth_mellon: logout processing leads to denial of service