The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and     simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote     attackers to spoof SAML responses or possibly cause a denial of service (memory consumption) by leveraging     improper conversion of return values to boolean. (CVE-2016-9814)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and
    simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote
    attackers to spoof SAML responses or possibly cause a denial of service (memory consumption) by leveraging
    improper conversion of return values to boolean. (CVE-2016-9814)

Several vulnerabilities have been discovered in SimpleSAMLphp, a framework for authentication, primarily via the SAML protocol.

CVE-2016-9814 & CVE-2016-9955

An incorrect check of return values in the signature validation utilities allowed an attacker to get invalid signatures accepted as valid in the rare case of an error occurring during validation.

SSPSA-201802-01 (no CVE yet)

Critical signature validation vulnerability.

In addition this update adds a patch to solve excessive resource consumption in case of SimpleSAMLphp processing a large metadata file.

For Debian 7 'Wheezy', these problems have been fixed in version 1.9.2-1+deb7u3.

We recommend that you upgrade your simplesamlphp packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
254678	Linux Distros Unpatched Vulnerability : CVE-2016-9814	Nessus	Misc.	critical
433518	SCA: security update for simplesamlphp/saml2 (GHSA-r8v4-7vwj-983x)	Tenable Cloud Security	SCA Checks	critical
433518	SCA: security update for simplesamlphp/saml2 (GHSA-r8v4-7vwj-983x)	Tenable Self-Hosted Container Security	SCA Checks	critical
107133	Debian DLA-1298-1 : simplesamlphp security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-9814

critical

Tenable Plugins

critical

critical

critical

critical