PT-2017-10393 · Uninett · Simplesamlphp

Thijs Kinkhorst · Published 2017-02-16 · Updated 2020-01-24 · CVE-2016-9955

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp versions prior to 1.14.11

Description The issue allows remote attackers to spoof signatures on SAML 1 responses or possibly cause a denial of service by leveraging improper conversion of return values to boolean in the SimpleSAML XML Validator class constructor. This is due to an incorrect check of return values in the signature validation utilities, which can be exploited by forcing an error during validation. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Technical details about exploitation include the use of openssl verify() function, which returns 1 when the signature was successfully verified, 0 if it failed to verify with the given key, and -1 in case an error occurs. The implicit conversion to boolean of the values returned by openssl verify() can convert an error state to successful verification of the signature. To exploit the issue, SAML 1.1 metadata must be registered by the vulnerable Service Provider for the Identity Provider targeted by the attacker, and an incorrect context must be fed to the signature validation routines, or an exceptional error must be triggered.

Recommendations Upgrade to the latest version of SimpleSAMLphp, which is 1.14.11 or later, to resolve the issue. As a temporary workaround, consider restricting access to the SimpleSAML XML Validator class constructor until a patch is available. Avoid using the verify() method from the RobRichardsXMLSecDSig class with untrusted input until the issue is resolved.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-9955

DLA-1298-1

GHSA-P9CM-R7JG-8Q3G

Affected Products

Simplesamlphp

References · 16

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2016-9955.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2016-9955 · Vendor Advisory
• https://simplesamlphp.org/security/201612-02 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9955 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-9955 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9955 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9955 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-9955 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p9cm-r7jg-8q3g · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9955 · Vendor Advisory
• https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-p9cm-r7jg-8q3g · Note
• https://github.com/simplesamlphp/simplesamlphp/commit/a2326d75dd14accaac162dd2cb30aaefcc1f9205 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9955 · Note
• http://openwall.com/lists/oss-security/2016/12/14/7 · Note
• https://lists.debian.org/debian-lts-announce/2018/03/msg00001.html · Note