PT-2019-6543 · Openssl+1 · Openssl+1

Dominic Hargreaves · Published 2019-11-07 · Updated 2019-11-13 · CVE-2010-2450

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shibboleth SP version 2.0

Description The keygen.sh script in Shibboleth SP uses OpenSSL to create a DES private key, which is placed in sp-key.pm. This script relies on the root umask instead of setting the permissions for the resulting file, making the generated private key world-readable by default.

Recommendations For Shibboleth SP version 2.0, consider modifying the keygen.sh script to properly set the permissions for the generated private key, or manually change the permissions of the sp-key.pm file to prevent it from being world-readable. As a temporary workaround, restrict access to the sp-key.pm file to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-916

CWE-200

Related Identifiers

CVE-2010-2450

Affected Products

Openssl

Shibboleth-Sp

References · 5

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=571631 · Patch
• https://security-tracker.debian.org/tracker/CVE-2010-2450 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2450 · Security Note
• https://todos.internet2.edu/browse/SSPCPP-106 · Note
• https://t.me/cibsecurity/8091 · Telegram Post