Improper Verification of Cryptographic Signature in Debian Linux

1) Improper Verification of Cryptographic Signature

EUVDB-ID: #VU37567

Risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-18122

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid. Attributes contained in all the assertions received will be merged and the entityID of the first assertion received will be used, allowing an attacker to impersonate any user of any IdP given an assertion signed by the targeted IdP.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Debian Linux: 7.0 - 9.0

CPE2.3

• cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

External links

https://lists.debian.org/debian-lts-announce/2018/02/msg00008.html
https://simplesamlphp.org/security/201710-01
https://www.debian.org/security/2018/dsa-4127

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.