cnvd - cnvd-2018-10675

CNVD-2018-10675

Vulnerability from cnvd - Published: 2018-05-31

Title

Symantec Advanced Secure Gateway和ProxySG身份验证绕过漏洞

Description

Symantec Advanced Secure Gateway（ASG）和ProxySG都是美国赛门铁克（Symantec）公司的安全网关设备。 Symantec ASG和ProxySG中存在身份验证绕过漏洞。远程攻击者可利用该漏洞修改有效的SAML响应并保持响应加密签名有效，从而绕过ASG和ProxySG中身份验证的安全控制。

Severity

中

Formal description

目前厂商暂未发布修复措施解决此安全问题，建议使用此软件的用户随时关注厂商主页或参考网址以获取解决办法： https://www.symantec.com/

Reference

https://nvd.nist.gov/vuln/detail/CVE-2018-5241

Impacted products

Name
['Symantec ProxySG 6.6', 'Symantec Advanced Secure Gateway 6.6', 'Symantec Advanced Secure Gateway 6.7', 'Symantec ProxySG 6.5', 'Symantec ProxySG 6.7']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-5241"
    }
  },
  "description": "Symantec Advanced Secure Gateway\uff08ASG\uff09\u548cProxySG\u90fd\u662f\u7f8e\u56fd\u8d5b\u95e8\u94c1\u514b\uff08Symantec\uff09\u516c\u53f8\u7684\u5b89\u5168\u7f51\u5173\u8bbe\u5907\u3002\r\n\r\nSymantec ASG\u548cProxySG\u4e2d\u5b58\u5728\u8eab\u4efd\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4fee\u6539\u6709\u6548\u7684SAML\u54cd\u5e94\u5e76\u4fdd\u6301\u54cd\u5e94\u52a0\u5bc6\u7b7e\u540d\u6709\u6548\uff0c\u4ece\u800c\u7ed5\u8fc7ASG\u548cProxySG\u4e2d\u8eab\u4efd\u9a8c\u8bc1\u7684\u5b89\u5168\u63a7\u5236\u3002",
  "discovererName": "Symantec",
  "formalWay": "\u76ee\u524d\u5382\u5546\u6682\u672a\u53d1\u5e03\u4fee\u590d\u63aa\u65bd\u89e3\u51b3\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u5efa\u8bae\u4f7f\u7528\u6b64\u8f6f\u4ef6\u7684\u7528\u6237\u968f\u65f6\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u6216\u53c2\u8003\u7f51\u5740\u4ee5\u83b7\u53d6\u89e3\u51b3\u529e\u6cd5\uff1a\r\nhttps://www.symantec.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-10675",
  "openTime": "2018-05-31",
  "products": {
    "product": [
      "Symantec ProxySG 6.6",
      "Symantec Advanced Secure Gateway 6.6",
      "Symantec Advanced Secure Gateway 6.7",
      "Symantec ProxySG 6.5",
      "Symantec ProxySG 6.7"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2018-5241",
  "serverity": "\u4e2d",
  "submitTime": "2018-05-31",
  "title": "Symantec Advanced Secure Gateway\u548cProxySG\u8eab\u4efd\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2018-5241 (GCVE-0-2018-5241)

Vulnerability from cvelistv5 – Published: 2018-05-29 13:00 – Updated: 2024-09-17 03:28

Summary

Symantec Advanced Secure Gateway (ASG) 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, ASG and ProxySG incorrectly handle XML nodes with comments. A remote attacker can modify a valid SAML response without invalidating its cryptographic signature. This may allow the attacker to bypass user authentication security controls in ASG and ProxySG. This vulnerability only affects authentication of network users in intercepted traffic. It does not affect administrator user authentication for the ASG and ProxySG management consoles.

Severity ?

No CVSS data available.

CWE

Authentication bypass

Assigner

symantec

References

URL

Tags

	https://www.symantec.com/security-center/network-…	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1040993	vdb-entryx_refsource_SECTRACK
	http://www.securityfocus.com/bid/104282	vdb-entryx_refsource_BID

Impacted products

Vendor

Product

Version

Symantec Corporation

Advanced Secure Gateway (ASG)

Affected: 6.6
Affected: 6.7

Symantec Corporation

ProxySG

Affected: 6.5
Affected: 6.6
Affected: 6.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T05:33:42.763Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.symantec.com/security-center/network-protection-security-advisories/SA167"
          },
          {
            "name": "1040993",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1040993"
          },
          {
            "name": "104282",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104282"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Advanced Secure Gateway (ASG)",
          "vendor": "Symantec Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "status": "affected",
              "version": "6.7"
            }
          ]
        },
        {
          "product": "ProxySG",
          "vendor": "Symantec Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "status": "affected",
              "version": "6.7"
            }
          ]
        }
      ],
      "datePublic": "2018-05-25T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Symantec Advanced Secure Gateway (ASG) 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, ASG and ProxySG incorrectly handle XML nodes with comments. A remote attacker can modify a valid SAML response without invalidating its cryptographic signature. This may allow the attacker to bypass user authentication security controls in ASG and ProxySG. This vulnerability only affects authentication of network users in intercepted traffic. It does not affect administrator user authentication for the ASG and ProxySG management consoles."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Authentication bypass",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-05-30T09:57:01",
        "orgId": "80d3bcb6-88de-48c2-a47e-aebf795f19b5",
        "shortName": "symantec"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.symantec.com/security-center/network-protection-security-advisories/SA167"
        },
        {
          "name": "1040993",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1040993"
        },
        {
          "name": "104282",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104282"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@symantec.com",
          "DATE_PUBLIC": "2018-05-25T00:00:00",
          "ID": "CVE-2018-5241",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Advanced Secure Gateway (ASG)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.6"
                          },
                          {
                            "version_value": "6.7"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ProxySG",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.5"
                          },
                          {
                            "version_value": "6.6"
                          },
                          {
                            "version_value": "6.7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Symantec Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Symantec Advanced Secure Gateway (ASG) 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, ASG and ProxySG incorrectly handle XML nodes with comments. A remote attacker can modify a valid SAML response without invalidating its cryptographic signature. This may allow the attacker to bypass user authentication security controls in ASG and ProxySG. This vulnerability only affects authentication of network users in intercepted traffic. It does not affect administrator user authentication for the ASG and ProxySG management consoles."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Authentication bypass"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.symantec.com/security-center/network-protection-security-advisories/SA167",
              "refsource": "CONFIRM",
              "url": "https://www.symantec.com/security-center/network-protection-security-advisories/SA167"
            },
            {
              "name": "1040993",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1040993"
            },
            {
              "name": "104282",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104282"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "80d3bcb6-88de-48c2-a47e-aebf795f19b5",
    "assignerShortName": "symantec",
    "cveId": "CVE-2018-5241",
    "datePublished": "2018-05-29T13:00:00Z",
    "dateReserved": "2018-01-05T00:00:00",
    "dateUpdated": "2024-09-17T03:28:24.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2018-10675

CVE-2018-5241 (GCVE-0-2018-5241)

Tags

Sightings

Nomenclature