PT-2018-16832 · Symantec · Symantec Advanced Secure Gateway+1

Published 2018-05-29 · Updated 2021-07-08 · CVE-2018-5241

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Symantec Advanced Secure Gateway (ASG) versions 6.6 through 6.7 ProxySG versions 6.5 through 6.7

Description The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, the products incorrectly handle XML nodes with comments. A remote attacker can modify a valid SAML response without invalidating its cryptographic signature, potentially allowing the attacker to bypass user authentication security controls. This issue only affects authentication of network users in intercepted traffic and does not affect administrator user authentication for the management consoles.

Recommendations For Symantec Advanced Secure Gateway (ASG) versions 6.6 through 6.7, consider disabling SAML authentication until a patch is available. For ProxySG versions 6.5 through 6.7, consider disabling SAML authentication until a patch is available. As a temporary workaround, restrict access to the SAML authentication realm to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2018-5241

Affected Products

Proxysg

Symantec Advanced Secure Gateway

References · 6

• https://symantec.com/security-center/network-protection-security-advisories/SA167 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5241 · Security Note
• https://osv.dev/vulnerability/CVE-2018-5241 · Vendor Advisory
• https://t.me/cvenotify/17268 · Telegram Post
• http://securitytracker.com/id/1040993 · Note
• http://securityfocus.com/bid/104282 · Note