Return
-
Title
Active Roles RSTS Critical Security hotfix -
Description
A security vulnerability was discovered in one of the authentication components that may be used when logging into the Active Roles Web Interface. This vulnerability could allow an attacker to gain unauthorized access.How does this affect me?If you have installed and configured the Redistributable STS component by following the section located in Appendix E of the Active Roles Administration Guide (versions 7.4.x and 7.5) and your users authenticate against an identity provider STS such as Microsoft ADFS, Microsoft Azure AD, Okta, or Ping Federate you may be affected by this security vulnerability. -
Resolution
AM I IMPACTED?
To check if rSTS is installed and configured, do the following:
- On the Active Roles server, launch Active Roles Configuration Center
- Click on Web Interface (left menu)
- Select Authentication (far right)
- If Default is selected, you are not impacted. No further action is required
- If Federated is selected, check the Identity Provider setting
- If rSTS is selected, download and install the appropriate hotfix below.
RESOLUTION
If Federated is configured and RSTS is the Identity Provider as noted above, download the appropriate hotfix.
Active Roles 7.4.1, please download the hotfix here.
Active Roles 7.4.3, please download the hotfix here.
Active Roles 7.4.4, please download the hotfix here.
Active Roles 7.4.5, please download the hotfix here.
Active Roles 7.5.0, please download the hotfix here.
Installing this hotfix
To install this hotfix
For 7.4.x, do the following:
- Extract the contents of the .zip archive into a temporary folder on the local drive where Active Roles is installed.
- Rename the extracted Active_Roles-7.4.x-337963.exe.rename file to remove the .rename file name extension.
- Run the file Active_Roles-7.4.x-337963.exe and follow the on-screen instructions to complete the hotfix installation.
For 7.5.0, please review the included ReadMe for specific installation instructions for this version.