SimpleSAMLphp Session fixation issue and authentication bypass in the authcrypt module
The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2017-12868US | critical9.8 | — | ||
The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attack… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2017-12868.yamlWEB
- https://github.com/simplesamlphp/simplesamlphpPACKAGE
- https://github.com/simplesamlphp/simplesamlphp/commit/4bc629658e7b7d17c9ac3fe0da7dc5df71f1b85eWEB
- https://lists.debian.org/debian-lts-announce/2017/12/msg00007.htmlWEB
- https://lists.debian.org/debian-lts-announce/2018/06/msg00017.htmlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2017-12868ADVISORY
- https://simplesamlphp.org/security/201705-01WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan