NetIQ Access Manager up to 4.1.2/4.2.1 SAML Request xml external entity reference

Summaryinfo

A vulnerability classified as critical was found in NetIQ Access Manager up to 4.1.2/4.2.1. This affects an unknown function of the component SAML Request Handler. Executing a manipulation can lead to xml external entity reference. This vulnerability is tracked as CVE-2016-5749. The attack is restricted to local execution. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in NetIQ Access Manager up to 4.1.2/4.2.1 (Access Management Software) and classified as critical. This vulnerability affects an unknown function of the component SAML Request Handler. The manipulation with an unknown input leads to a xml external entity reference vulnerability. The CWE definition for the vulnerability is CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to local file disclosure via an XML External Entity (XXE) attack.

The bug was discovered 07/04/2016. The weakness was disclosed 03/23/2017 (Website). The advisory is shared for download at novell.com. This vulnerability was named CVE-2016-5749 since 06/23/2016. The exploitation appears to be easy. The attack needs to be approached locally. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 262 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 4.1.2 HF2 or 4.2.2 eliminates this vulnerability.

The entries VDB-98396, VDB-98395, VDB-98394 and VDB-98393 are pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Access Management Software

Vendor

• NetIQ

Name

• Access Manager

Version

• 4.1.0
• 4.1.1
• 4.1.2
• 4.2.0
• 4.2.1

License

• commercial

Website

• Vendor: https://www.microfocus.com/netiq/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion