CVE-2019-9628

Vulnerability

The XMLTooling library, included with OpenSAML and Shibboleth Service Provider software, contains an XML parsing class that fails to properly handle exceptions triggered by malformed XML declarations. Invalid data in the XML declaration causes an exception of an unexpected type to propagate unhandled, leading to a crash of the calling application [1][4].

Exploitation

The crash occurs before any message authenticity evaluation, allowing an untrusted attacker to trigger the denial-of-service by sending a crafted XML declaration to a service using the vulnerable library. No authentication is required; the attack can be performed remotely over the network [4]. This vulnerability is not limited to V3 of XMLTooling; it is believed to affect all versions prior to 3.0.4 [4].

Impact

Successful exploitation results in a denial-of-service (DoS) condition. In typical Shibboleth SP deployments, this manifests as a crash of the shibd daemon process, but can also affect Apache HTTPD in some configurations [4]. The attacker gains no ability to read or modify data, but can disrupt service availability.

Mitigation

The vulnerability is remediated in XMLTooling version 3.0.4. The Shibboleth SP V3.0.4 patch release includes the updated library for Windows; Linux and other platforms should update the xmltooling package to 3.0.4 or later [4]. Ubuntu packages have been fixed as of 2019 via the Launchpad bug tracker [1]. No workarounds are documented.