Vulnerabilities > CVE-2017-16853 - Improper Verification of Cryptographic Signature vulnerability in multiple products

047910
CVSS 8.1 - HIGH
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
high complexity
shibboleth
debian
CWE-347
nessus
NVD
Published: 2017-11-16
Updated: 2023-11-07

Summary

The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.

Vulnerable Configurations

Part Description Count
Application
Shibboleth
11
OS
Debian
2

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Padding Oracle Crypto Attack
    An attacker is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext. A target system that leaks this type of information becomes the padding oracle and an attacker is able to make use of that oracle to efficiently decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). In addition to performing decryption, an attacker is also able to produce valid ciphertexts (i.e., perform encryption) by using the padding oracle, all without knowing the encryption key. Any cryptosystem can be vulnerable to padding oracle attacks if the encrypted messages are not authenticated to ensure their validity prior to decryption, and then the information about padding error is leaked to the attacker. This attack technique may be used, for instance, to break CAPTCHA systems or decrypt/modify state information stored in client side objects (e.g., hidden fields or cookies). This attack technique is a side-channel attack on the cryptosystem that uses a data leak from an improperly implemented decryption routine to completely subvert the cryptosystem. The one bit of information that tells the attacker whether a padding error during decryption has occurred, in whatever form it comes, is sufficient for the attacker to break the cryptosystem. That bit of information can come in a form of an explicit error message about a padding error, a returned blank page, or even the server taking longer to respond (a timing attack). This attack can be launched cross domain where an attacker is able to use cross-domain information leaks to get the bits of information from the padding oracle from a target system / service with which the victim is communicating. To do so an attacker sends a request containing ciphertext to the target system. Due to the browser's same origin policy, the attacker is not able to see the response directly, but can use cross-domain information leak techniques to still get the information needed (i.e., information on whether or not a padding error has occurred). For instance, this can be done using "img" tag plus the onerror()/onload() events. The attacker's JavaScript can make web browsers to load an image on the target site, and know if the image is loaded or not. This is 1-bit information needed for the padding oracle attack to work: if the image is loaded, then it is valid padding, otherwise it is not.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-3234-1.NASL
    descriptionThis update for opensaml fixes the following issues: Security issue fixed : - CVE-2017-16853: Fix the DynamicMetadataProvider class to properly configure itself with the MetadataFilter plugins, to avoid possible MITM attacks (bsc#1068685). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id105097
    published2017-12-08
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105097
    titleSUSE SLES12 Security Update : opensaml (SUSE-SU-2017:3234-1)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2017:3234-1.
# The text itself is copyright (C) SUSE.
#

include("compat.inc");

if (description)
{
  script_id(105097);
  script_version("3.6");
  script_cvs_date("Date: 2019/09/11 11:22:16");

  script_cve_id("CVE-2017-16853");

  script_name(english:"SUSE SLES12 Security Update : opensaml (SUSE-SU-2017:3234-1)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SUSE host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for opensaml fixes the following issues: Security issue
fixed :

  - CVE-2017-16853: Fix the DynamicMetadataProvider class to
    properly configure itself with the MetadataFilter
    plugins, to avoid possible MITM attacks (bsc#1068685).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1068685"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-16853/"
  );
  # https://www.suse.com/support/update/announcement/2017/suse-su-20173234-1/
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?efbc08e1"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t
patch SUSE-SLE-SDK-12-SP3-2017-2011=1

SUSE Linux Enterprise Software Development Kit 12-SP2:zypper in -t
patch SUSE-SLE-SDK-12-SP2-2017-2011=1

SUSE Linux Enterprise Server for Raspberry Pi 12-SP2:zypper in -t
patch SUSE-SLE-RPI-12-SP2-2017-2011=1

SUSE Linux Enterprise Server 12-SP3:zypper in -t patch
SUSE-SLE-SERVER-12-SP3-2017-2011=1

SUSE Linux Enterprise Server 12-SP2:zypper in -t patch
SUSE-SLE-SERVER-12-SP2-2017-2011=1

To bring your system up-to-date, use 'zypper patch'."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libsaml8");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libsaml8-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:opensaml-bin");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:opensaml-bin-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:opensaml-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:opensaml-schemas");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/11/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/12/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/12/08");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES12", "SUSE " + os_ver);

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);

sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES12" && (! preg(pattern:"^(2|3)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP2/3", os_ver + " SP" + sp);


flag = 0;
if (rpm_check(release:"SLES12", sp:"3", reference:"libsaml8-2.5.5-3.3.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libsaml8-debuginfo-2.5.5-3.3.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"opensaml-bin-2.5.5-3.3.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"opensaml-bin-debuginfo-2.5.5-3.3.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"opensaml-debugsource-2.5.5-3.3.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"opensaml-schemas-2.5.5-3.3.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libsaml8-2.5.5-3.3.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libsaml8-debuginfo-2.5.5-3.3.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"opensaml-bin-2.5.5-3.3.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"opensaml-bin-debuginfo-2.5.5-3.3.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"opensaml-debugsource-2.5.5-3.3.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"opensaml-schemas-2.5.5-3.3.1")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "opensaml");
}
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-1350.NASL
    descriptionThis update for opensaml fixes the following issues : Security issue fixed : - CVE-2017-16853: Fix the DynamicMetadataProvider class to properly configure itself with the MetadataFilter plugins, to avoid possible MITM attacks (bsc#1068685). This update was imported from the SUSE:SLE-12-SP1:Update update project.
    last seen2020-06-05
    modified2017-12-14
    plugin id105236
    published2017-12-14
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/105236
    titleopenSUSE Security Update : opensaml (openSUSE-2017-1350)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2017-1350.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(105236);
  script_version("3.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2017-16853");

  script_name(english:"openSUSE Security Update : opensaml (openSUSE-2017-1350)");
  script_summary(english:"Check for the openSUSE-2017-1350 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for opensaml fixes the following issues :

Security issue fixed :

  - CVE-2017-16853: Fix the DynamicMetadataProvider class to
    properly configure itself with the MetadataFilter
    plugins, to avoid possible MITM attacks (bsc#1068685).

This update was imported from the SUSE:SLE-12-SP1:Update update
project."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1068685"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected opensaml packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsaml-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsaml8");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsaml8-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:opensaml-bin");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:opensaml-bin-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:opensaml-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:opensaml-schemas");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.3");

  script_set_attribute(attribute:"patch_publication_date", value:"2017/12/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/12/14");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2017-2020 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE42\.2|SUSE42\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.2 / 42.3", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE42.2", reference:"libsaml-devel-2.5.5-3.3.1") ) flag++;
if ( rpm_check(release:"SUSE42.2", reference:"libsaml8-2.5.5-3.3.1") ) flag++;
if ( rpm_check(release:"SUSE42.2", reference:"libsaml8-debuginfo-2.5.5-3.3.1") ) flag++;
if ( rpm_check(release:"SUSE42.2", reference:"opensaml-bin-2.5.5-3.3.1") ) flag++;
if ( rpm_check(release:"SUSE42.2", reference:"opensaml-bin-debuginfo-2.5.5-3.3.1") ) flag++;
if ( rpm_check(release:"SUSE42.2", reference:"opensaml-debugsource-2.5.5-3.3.1") ) flag++;
if ( rpm_check(release:"SUSE42.2", reference:"opensaml-schemas-2.5.5-3.3.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"libsaml-devel-2.5.5-6.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"libsaml8-2.5.5-6.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"libsaml8-debuginfo-2.5.5-6.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"opensaml-bin-2.5.5-6.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"opensaml-bin-debuginfo-2.5.5-6.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"opensaml-debugsource-2.5.5-6.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"opensaml-schemas-2.5.5-6.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libsaml-devel / libsaml8 / libsaml8-debuginfo / opensaml-bin / etc");
}
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1178.NASL
    descriptionRod Widdowson of Steading System Software LLP discovered a coding error in the OpenSAML library, causing the DynamicMetadataProvider class to fail configuring itself with the filters provided and omitting whatever checks they are intended to perform. For Debian 7
    last seen2020-03-17
    modified2017-11-20
    plugin id104681
    published2017-11-20
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/104681
    titleDebian DLA-1178-1 : opensaml2 security update
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory DLA-1178-1. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(104681);
  script_version("3.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2017-16853");

  script_name(english:"Debian DLA-1178-1 : opensaml2 security update");
  script_summary(english:"Checks dpkg output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Rod Widdowson of Steading System Software LLP discovered a coding
error in the OpenSAML library, causing the DynamicMetadataProvider
class to fail configuring itself with the filters provided and
omitting whatever checks they are intended to perform.

For Debian 7 'Wheezy', these problems have been fixed in version
2.4.3-4+deb7u2.

We recommend that you upgrade your opensaml2 packages.

NOTE: Tenable Network Security has extracted the preceding description
block directly from the DLA security advisory. Tenable has attempted
to automatically clean and format it as much as possible without
introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/wheezy/opensaml2"
  );
  script_set_attribute(attribute:"solution", value:"Upgrade the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libsaml2-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libsaml2-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libsaml7");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:opensaml2-schemas");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:opensaml2-tools");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2017/11/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/11/20");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2017-2020 Tenable Network Security, Inc.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"7.0", prefix:"libsaml2-dev", reference:"2.4.3-4+deb7u2")) flag++;
if (deb_check(release:"7.0", prefix:"libsaml2-doc", reference:"2.4.3-4+deb7u2")) flag++;
if (deb_check(release:"7.0", prefix:"libsaml7", reference:"2.4.3-4+deb7u2")) flag++;
if (deb_check(release:"7.0", prefix:"opensaml2-schemas", reference:"2.4.3-4+deb7u2")) flag++;
if (deb_check(release:"7.0", prefix:"opensaml2-tools", reference:"2.4.3-4+deb7u2")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4039.NASL
    descriptionRod Widdowson of Steading System Software LLP discovered a coding error in the OpenSAML library, causing the DynamicMetadataProvider class to fail configuring itself with the filters provided and omitting whatever checks they are intended to perform. See https://shibboleth.net/community/advisories/secadv_20171115.txt for details.
    last seen2020-06-01
    modified2020-06-02
    plugin id104645
    published2017-11-17
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104645
    titleDebian DSA-4039-1 : opensaml2 - security update
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-4039. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(104645);
  script_version("3.4");
  script_cvs_date("Date: 2018/11/10 11:49:38");

  script_cve_id("CVE-2017-16853");
  script_xref(name:"DSA", value:"4039");

  script_name(english:"Debian DSA-4039-1 : opensaml2 - security update");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Rod Widdowson of Steading System Software LLP discovered a coding
error in the OpenSAML library, causing the DynamicMetadataProvider
class to fail configuring itself with the filters provided and
omitting whatever checks they are intended to perform.

See https://shibboleth.net/community/advisories/secadv_20171115.txt
for details."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=881856"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://shibboleth.net/community/advisories/secadv_20171115.txt"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/jessie/opensaml2"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/stretch/opensaml2"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2017/dsa-4039"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the opensaml2 packages.

For the oldstable distribution (jessie), this problem has been fixed
in version 2.5.3-2+deb8u2.

For the stable distribution (stretch), this problem has been fixed in
version 2.6.0-4+deb9u1."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:opensaml2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:9.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2017/11/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/11/17");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"8.0", prefix:"libsaml2-dev", reference:"2.5.3-2+deb8u2")) flag++;
if (deb_check(release:"8.0", prefix:"libsaml2-doc", reference:"2.5.3-2+deb8u2")) flag++;
if (deb_check(release:"8.0", prefix:"libsaml8", reference:"2.5.3-2+deb8u2")) flag++;
if (deb_check(release:"8.0", prefix:"opensaml2-schemas", reference:"2.5.3-2+deb8u2")) flag++;
if (deb_check(release:"8.0", prefix:"opensaml2-tools", reference:"2.5.3-2+deb8u2")) flag++;
if (deb_check(release:"9.0", prefix:"libsaml2-dev", reference:"2.6.0-4+deb9u1")) flag++;
if (deb_check(release:"9.0", prefix:"libsaml2-doc", reference:"2.6.0-4+deb9u1")) flag++;
if (deb_check(release:"9.0", prefix:"libsaml9", reference:"2.6.0-4+deb9u1")) flag++;
if (deb_check(release:"9.0", prefix:"opensaml2-schemas", reference:"2.6.0-4+deb9u1")) flag++;
if (deb_check(release:"9.0", prefix:"opensaml2-tools", reference:"2.6.0-4+deb9u1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

References