Samhain SRP Authentication Bypass Vulnerability

Bugtraq ID:	34003
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 05 2009 12:00AM
Updated:	Mar 06 2009 06:56PM
Credit:	Thomas Ptacek
Vulnerable:	Samhain Labs Samhain 2.4.1 Samhain Labs Samhain 2.4 a Samhain Labs Samhain 2.4 Samhain Labs Samhain 2.0.2 Samhain Labs Samhain 2.0.1
Not Vulnerable:	Samhain Labs Samhain 2.5.4

Samhain SRP Authentication Bypass Vulnerability

Samhain is prone to a vulnerability that allows an attacker to bypass authentication and gain unauthorized access to the affected application.

Attackers may exploit this issue to connect to the application without proper authentication. This may lead to a compromise of the application or may aid in further attacks.

Versions prior to Samhain 2.5.4 are vulnerable.

Samhain SRP Authentication Bypass Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Samhain SRP Authentication Bypass Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.

Samhain SRP Authentication Bypass Vulnerability

References:

• Flawed input verification in SRP (rainer)
  
• Samhain Product Page (Samhain Labs)