CVE-2017-12868 : Security Advisory and Response

SimpleSAMLphp version 1.14.13 and earlier has a vulnerability in the secureCompare method that can lead to session fixation attacks or authentication bypass.

Understanding CVE-2017-12868

What is CVE-2017-12868?

The secureCompare method in SimpleSAMLphp 1.14.13 and earlier, when used with PHP versions before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by exploiting missing character conversions.

The Impact of CVE-2017-12868

This vulnerability can enable malicious actors to launch session fixation attacks or potentially bypass authentication by exploiting the absence of character conversions prior to an XOR operation.

Technical Details of CVE-2017-12868

Vulnerability Description

The vulnerability exists in the secureCompare method located in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp version 1.14.13 and earlier.

Affected Systems and Versions

Product: SimpleSAMLphp
Vendor: N/A
Versions affected: 1.14.13 and earlier

Exploitation Mechanism

Attackers can exploit this vulnerability when using PHP versions earlier than 5.6.

Mitigation and Prevention

Immediate Steps to Take

Update SimpleSAMLphp to a version that addresses this vulnerability.
Implement character conversions before XOR operations to prevent exploitation.

Long-Term Security Practices

Regularly update software and libraries to the latest versions.
Conduct security audits to identify and address vulnerabilities proactively.

Patching and Updates

Refer to security advisories from SimpleSAMLphp and relevant sources for patching instructions.