CVE-2016-2403
critical
CVSS v3
9.8
CVSS v2
7.5
VIR risk
9.8
Description
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2016-2403
Vendor advisory: cve@mitre.org — http://symfony.com/blog/cve-2016-2403-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-password
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 2.8.6+dfsg-1 |
| debian | bullseye | fixed | 2.8.6+dfsg-1 |
| debian | forky | fixed | 2.8.6+dfsg-1 |
| debian | sid | fixed | 2.8.6+dfsg-1 |
| debian | trixie | fixed | 2.8.6+dfsg-1 |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Packagist | symfony/security-core | >=2.8.0,<2.8.6 | 2.8.6 |
| Packagist | symfony/security-core | >=3.0.0,<3.0.6 | 3.0.6 |
| Packagist | symfony/security | >=2.8.0,<2.8.6 | 2.8.6 |
| Packagist | symfony/security | >=3.0.0,<3.0.6 | 3.0.6 |
| Packagist | symfony/symfony | >=2.8.0,<2.8.6 | 2.8.6 |
| Packagist | symfony/symfony | >=3.0.0,<3.0.6 | 3.0.6 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| sensiolabs | symfony | 2.8.0 | |
| sensiolabs | symfony | 2.8.1 | |
| sensiolabs | symfony | 2.8.2 | |
| sensiolabs | symfony | 2.8.3 | |
| sensiolabs | symfony | 2.8.4 | |
| sensiolabs | symfony | 2.8.5 | |
| sensiolabs | symfony | 3.0.0 | |
| sensiolabs | symfony | 3.0.1 | |
| sensiolabs | symfony | 3.0.2 | |
| sensiolabs | symfony | 3.0.3 | |
| sensiolabs | symfony | 3.0.4 | |
| sensiolabs | symfony | 3.0.5 | |
References
- http://symfony.com/blog/cve-2016-2403-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-password
- http://www.securityfocus.com/bid/96137
- https://www.debian.org/security/2018/dsa-4262
- https://nvd.nist.gov/vuln/detail/CVE-2016-2403
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-core/CVE-2016-2403.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2016-2403.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2016-2403.yaml
- https://symfony.com/cve-2016-2403
- https://web.archive.org/web/20210123224944/http://www.securityfocus.com/bid/96137
- https://security-tracker.debian.org/tracker/CVE-2016-2403
CWEs
CWE-287
Verify integrity in audit chain (admin only). AS-IS.