PT-2017-10349 · Simplesamlphp · Simplesamlphp+1

Artem-Diverta · Published 2017-02-16 · Updated 2022-05-14 · CVE-2016-9814

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp versions prior to 1.14.10 simplesamlphp/saml2 library versions prior to 1.9.1 simplesamlphp/saml2 library 1.10.x versions prior to 1.10.3 simplesamlphp/saml2 library 2.x versions prior to 2.3.3

Description The issue allows remote attackers to spoof SAML responses or possibly cause a denial of service by leveraging improper conversion of return values to boolean in the validateSignature method. This method is part of the SAML2Utils class in SimpleSAMLphp and the simplesamlphp/saml2 library.

Recommendations For SimpleSAMLphp versions prior to 1.14.10, update to version 1.14.10 or later. For simplesamlphp/saml2 library versions prior to 1.9.1, update to version 1.9.1 or later. For simplesamlphp/saml2 library 1.10.x versions prior to 1.10.3, update to version 1.10.3 or later. For simplesamlphp/saml2 library 2.x versions prior to 2.3.3, update to version 2.3.3 or later. As a temporary workaround, consider disabling the validateSignature method until a patch is available.

Exploit

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2016-9814

DLA-1298-1

GHSA-R8V4-7VWJ-983X

Affected Products

Simplesamlphp

Simplesamlphp/Saml2

References · 17

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/saml2/CVE-2016-9814.yaml · Exploit
• https://simplesamlphp.org/security/201612-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9814 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9814 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9814 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9814 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9814 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-9814 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-9814 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r8v4-7vwj-983x · Vendor Advisory
• https://github.com/simplesamlphp/simplesamlphp · Note
• https://github.com/simplesamlphp/saml2/commit/7008b0916426212c1cc2fc238b38ab9ebff0748c · Note
• https://github.com/simplesamlphp/saml2/pull/81 · Note
• http://openwall.com/lists/oss-security/2016/12/03/5 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9814 · Note