CVE-2014-8566 and CVE-2014-8567: mod_auth_mellon issues affecting users of 0.8.0

[Murray McAllister <mmcallis () redhat com>]

Good morning,

mod_auth_mellon provides a SAML 2.0 authentication module for the Apache 
HTTP Server.

The below issues were fixed in the 0.9.0 and
0.9.1 releases, but not marked as security issues at the time. (An 0.8.1 
security update has been released too, 
<https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.8.1>)

While Red Hat ship version 0.8.0, it is expected that very few others 
would have been using this version (if any).

From 
<https://postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html>:

""
It turned out that session overflow bugs fixes in version 0.9.0 and
0.9.1 can lead to information disclosure, where data from one session
is leaked to another session. Depending on how this data is used by the
web application, this may lead to data from one session being disclosed
to an user in a different session. (CVE-2014-8566)

In addition to the information disclosure, this release contains some
fixes for logout processing, where logout requests would crash the
Apache web server. (CVE-2014-8567)
""

You may also come across 
<https://bugzilla.redhat.com/show_bug.cgi?id=1157955>. I originally 
thought 
<https://github.com/UNINETT/mod_auth_mellon/commit/47a767d5f37d1d3a1c004abbf8bb80d1b7eab328>/<http://jbp.io/2014/01/16/openssl-rand-api/#recommendations-and-patches> 
could lead to a predictable session cookie being returned, but it turns 
out that is not the case (and MITRE did not assign a CVE for this change).

Cheers,

--
Murray McAllister / Red Hat Product Security

https://bugzilla.redhat.com/show_bug.cgi?id=1157281
https://bugzilla.redhat.com/show_bug.cgi?id=1157954