Your message dated Wed, 10 Oct 2007 07:17:07 +0000
with message-id <[EMAIL PROTECTED]>
and subject line Bug#434645: fixed in shibboleth-sp 1.3f.dfsg1-5
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160
Package: libapache2-mod-shib
Version: 1.3f.dfsg1-2
Severity: grave
Tags: security
Tags: etch
X-Debbugs-CC: [EMAIL PROTECTED]
X-Debbugs-CC: [EMAIL PROTECTED]
After a high number of requests to a shibboleth protected URL, the
shibd process dies. It is irrelevant if the requests are made over a
long or short period of time. However, the misbehaviour was reproduced
using JMeter load tests with a few hundred requests using up to 20
parallel requests.
The misbehaviour could also be forced by using "ab", the Apache HTTP server
benchmarking tool.
After shibd dies, users can no longer access to shibboleh protected
content on the Apache httpd. Therefore, the package libapache2-mod-shib
has to be regarded as being vulnerable to denial of service attacks.
A core dump of the shibd process:
- ----
#0 0xb7fcb410 in ?? ()
#1 0xb244973c in ?? ()
#2 0x00000006 in ?? ()
#3 0x0000079a in ?? ()
#4 0xb75c2811 in raise () from /lib/tls/i686/cmov/libc.so.6
#5 0xb75c3fb9 in abort () from /lib/tls/i686/cmov/libc.so.6
#6 0xb75f7d3a in __fsetlocking () from /lib/tls/i686/cmov/libc.so.6
#7 0xb75ff5cf in mallopt () from /lib/tls/i686/cmov/libc.so.6
#8 0xb75ff672 in free () from /lib/tls/i686/cmov/libc.so.6
#9 0xb77bc3b1 in operator delete () from /usr/lib/libstdc++.so.6
#10 0xb7798ebd in std::string::_Rep::_M_destroy () from /usr/lib/libstdc++.so.6
#11 0xb7f0443d in log4cpp::NDC::_pop () from /usr/lib/liblog4cpp.so.4
#12 0xb7f0393b in log4cpp::NDC::pop () from /usr/lib/liblog4cpp.so.4
#13 0xb7e5da42 in saml::NDC::~NDC () from /usr/lib/libsaml.so.5
#14 0x0805133c in xercesc_2_7::XMLDeleter::~XMLDeleter ()
#15 0x08052961 in shibboleth::InvalidSessionException::~InvalidSessionException
()
#16 0xb768b380 in svc_getreq_common () from /lib/tls/i686/cmov/libc.so.6
#17 0xb768acdf in svc_getreqset () from /lib/tls/i686/cmov/libc.so.6
#18 0x0804e105 in xercesc_2_7::XMLDeleter::~XMLDeleter ()
#19 0x0804e3e1 in xercesc_2_7::XMLDeleter::~XMLDeleter ()
#20 0xb76d0240 in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#21 0xb76653de in clone () from /lib/tls/i686/cmov/libc.so.6
- ----
The Shibboleth Service Provider source code is available at
http://shibboleth.internet2.edu/downloads/ .
Binary package available from the same source do not show this behaviour
because they are compiled with patched versions of the log4cpp and xerces-c
libararies.
In other words, this bug is specific to the Debian GNU/Linux distribution.
This is due to the fact the package libapache2-mod-shib uses the log4cpp and
xerces-c libraries within the Debian distribution. liblog4cpp4 is not thread-
safe and libxerces27 handles memory allocation wrongly at least when used
with shibd.
Details about the system where the tests were made:
Linux debian 2.6.18-4-686 #1 SMP Wed May 9 23:03:12 UTC 2007 i686 GNU/Linux
Shared C library version: 2.3.6.ds1-13
Best regards,
Patrik Schnellmann
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)
iD8DBQFGp13t5a+rANulz7oRA3TyAJ9OWypBBb0bJJGJ2DY3YuybPQiPggCgov4X
hyYopkQH/yF1nEgc/nDy7Gk=
=IUG8
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
Source: shibboleth-sp
Source-Version: 1.3f.dfsg1-5
We believe that the bug you reported is fixed in the latest version of
shibboleth-sp, which is due to be installed in the Debian FTP archive:
libapache2-mod-shib_1.3f.dfsg1-5_i386.deb
to pool/main/s/shibboleth-sp/libapache2-mod-shib_1.3f.dfsg1-5_i386.deb
libshib-dev_1.3f.dfsg1-5_i386.deb
to pool/main/s/shibboleth-sp/libshib-dev_1.3f.dfsg1-5_i386.deb
libshib-target5_1.3f.dfsg1-5_i386.deb
to pool/main/s/shibboleth-sp/libshib-target5_1.3f.dfsg1-5_i386.deb
libshib6_1.3f.dfsg1-5_i386.deb
to pool/main/s/shibboleth-sp/libshib6_1.3f.dfsg1-5_i386.deb
shibboleth-sp_1.3f.dfsg1-5.diff.gz
to pool/main/s/shibboleth-sp/shibboleth-sp_1.3f.dfsg1-5.diff.gz
shibboleth-sp_1.3f.dfsg1-5.dsc
to pool/main/s/shibboleth-sp/shibboleth-sp_1.3f.dfsg1-5.dsc
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Russ Allbery <[EMAIL PROTECTED]> (supplier of updated shibboleth-sp package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Tue, 09 Oct 2007 01:28:34 -0700
Source: shibboleth-sp
Binary: libapache2-mod-shib libshib6 libshib-dev libshib-target5
Architecture: source i386
Version: 1.3f.dfsg1-5
Distribution: unstable
Urgency: low
Maintainer: Russ Allbery <[EMAIL PROTECTED]>
Changed-By: Russ Allbery <[EMAIL PROTECTED]>
Description:
libapache2-mod-shib - Shibboleth implements the OASIS SAML v1.1 specification,
libshib-dev - Shibboleth federated authorization system (development)
libshib-target5 - Shibboleth implements the OASIS SAML v1.1 specification,
libshib6 - Shibboleth federated authorization system (development)
Closes: 434645 442729 445778
Changes:
shibboleth-sp (1.3f.dfsg1-5) unstable; urgency=low
.
* Rebuild against log4cpp 1.0. (Closes: #445778)
- Change CategoryStream::ENDLINE to log4cpp::eol for new API.
- Thread safety hopefully fixed. (Closes: #434645)
* Touch files after unapplying patches and before make distclean so that
make distclean doesn't try to re-run configure. (Closes: #442729)
* Remove files modified by autoreconf in debian/rules clean.
Files:
8b3d68b8c72b992a566b346c6cabfa39 879 web optional
shibboleth-sp_1.3f.dfsg1-5.dsc
b73ed449acd1e29abd707f1fcc703480 33940 web optional
shibboleth-sp_1.3f.dfsg1-5.diff.gz
cc394f2bd0003922e91ddb6b19b88e59 407858 libdevel extra
libshib-dev_1.3f.dfsg1-5_i386.deb
17cff374441900d9ac1c0627b95316a0 79496 libs optional
libshib6_1.3f.dfsg1-5_i386.deb
0b21ff50b629786e7b938ebc05460310 197620 libs optional
libshib-target5_1.3f.dfsg1-5_i386.deb
7e357486b7a4054b1bcca237d58f3164 3638170 web optional
libapache2-mod-shib_1.3f.dfsg1-5_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFHDHkA+YXjQAr8dHYRAm4/AJ0eHPdjeWDgGX5so4WE/0d5loM4JwCeLjbA
tBlxM8llCQp86JBmcqQl1To=
=ZRYB
-----END PGP SIGNATURE-----
--- End Message ---
