Vulnerability Name:

CVE-2019-3878 (CCN-158551)

Assigned:2018-05-10
Published:2018-05-10
Updated:2019-05-07
Summary:A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.
CVSS v3 Severity:8.1 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.1 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.6 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)
7.5 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
8.1 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
7.1 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-287
CWE-305
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2019-3878

Source: REDHAT
Type: UNKNOWN
RHBA-2019:0959

Source: REDHAT
Type: Third Party Advisory
RHSA-2019:0746

Source: REDHAT
Type: Third Party Advisory
RHSA-2019:0766

Source: REDHAT
Type: UNKNOWN
RHSA-2019:0985

Source: CONFIRM
Type: Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3878

Source: XF
Type: UNKNOWN
apache-cve20193878-sec-bypass(158551)

Source: CCN
Type: mod_auth_mellon GIT Repository
Modify am_handler setup to run before mod_proxy

Source: CONFIRM
Type: Exploit, Patch, Third Party Advisory
https://github.com/Uninett/mod_auth_mellon/pull/196

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2019-db1e9b3002

Source: FEDORA
Type: Mailing List, Release Notes, Third Party Advisory
FEDORA-2019-2d8ee47f61

Source: UBUNTU
Type: Third Party Advisory
USN-3924-1

Source: CCN
Type: Debian Security Advisory
DSA-4414-1 libapache2-mod-auth-mellon -- security update

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mod_auth_mellon_project:mod_auth_mellon:*:*:*:*:*:apache:*:* (Version < 0.14.2)

    • Configuration 2:
  • cpe:/o:fedoraproject:fedora:29:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:30:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.redhat.rhsa:def:20190985
    P
    		RHSA-2019:0985: mod_auth_mellon security update (Important)
    2019-05-07
    oval:com.redhat.rhsa:def:20190766
    P
    		RHSA-2019:0766: mod_auth_mellon security and bug fix update (Important)
    2019-04-16
    oval:com.ubuntu.xenial:def:201938780000000
    V
    		CVE-2019-3878 on Ubuntu 16.04 LTS (xenial) - medium.
    2019-03-26
    oval:com.ubuntu.bionic:def:20193878000
    V
    		CVE-2019-3878 on Ubuntu 18.04 LTS (bionic) - medium.
    2019-03-26
    oval:com.ubuntu.cosmic:def:20193878000
    V
    		CVE-2019-3878 on Ubuntu 18.10 (cosmic) - medium.
    2019-03-26
    oval:com.ubuntu.cosmic:def:201938780000000
    V
    		CVE-2019-3878 on Ubuntu 18.10 (cosmic) - medium.
    2019-03-26
    oval:com.ubuntu.disco:def:201938780000000
    V
    		CVE-2019-3878 on Ubuntu 19.04 (disco) - medium.
    2019-03-26
    oval:com.ubuntu.trusty:def:20193878000
    V
    		CVE-2019-3878 on Ubuntu 14.04 LTS (trusty) - medium.
    2019-03-26
    oval:com.ubuntu.bionic:def:201938780000000
    V
    		CVE-2019-3878 on Ubuntu 18.04 LTS (bionic) - medium.
    2019-03-26
    oval:com.ubuntu.xenial:def:20193878000
    V
    		CVE-2019-3878 on Ubuntu 16.04 LTS (xenial) - medium.
    2019-03-26
    BACK
    mod_auth_mellon_project mod auth mellon *
    fedoraproject fedora 29
    fedoraproject fedora 30
    redhat enterprise linux 7.0
    redhat enterprise linux desktop 7.0
    redhat enterprise linux server 7.0
    redhat enterprise linux server aus 7.6
    redhat enterprise linux server eus 7.6
    redhat enterprise linux server tus 7.6
    redhat enterprise linux workstation 7.0
    canonical ubuntu linux 18.04
    canonical ubuntu linux 18.10