PT-2017-12737 · Uninett+1 · Simplesamlphp+1

Jaime Pérez Crespo + 1 · Publicado 2017-09-01 · Atualizado 2022-05-14 · CVE-2017-12868

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp versions 1.14.13 and earlier

Description The issue concerns the secureCompare method in SimpleSAMLphp, which can be exploited to conduct session fixation attacks or possibly bypass authentication. This is due to missing character conversions before an XOR operation when used with PHP before version 5.6.

Recommendations For SimpleSAMLphp versions 1.14.13 and earlier, consider updating PHP to version 5.6 or later to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2017-12868

DLA-1205-1

DLA-1408-1

GHSA-J96G-47X2-46HV

Produtos afetados

Php

Simplesamlphp

Referências · 22

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2017-12868.yaml · Exploit
• https://github.com/simplesamlphp/simplesamlphp/commit/4bc629658e7b7d17c9ac3fe0da7dc5df71f1b85e · Correção
• https://github.com/simplesamlphp/simplesamlphp · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12868 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12868 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12868 · Aviso do Fabricante
• https://twitter.com/theinfosecguru/status/1066740799981977603 · Nota
• https://simplesamlphp.org/security/201705-01 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12868 · Nota de Segurança
• https://packages.debian.org/src:simplesamlphp · Nota
• https://osv.dev/vulnerability/DLA-1408-1 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2018/06/msg00017.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12872 · Nota de Segurança
• https://security-tracker.debian.org/tracker/DLA-1408-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-12868 · Nota de Segurança