CVE-2019-1006

An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary symmetric keys, aka 'WCF/WIF SAML Token Authentication Bypass Vulnerability'.

Score

CVSS 3.0 7.5 High

Status

Modified - secure@microsoft.com

Published

2019-07-15

Last modified

2024-08-04

Weaknesses

CWE-295

Affected products

• .net Framework (Microsoft)
• Identitymodel (Microsoft)
• Microsoft.identitymodel (Microsoft)
• Microsoft .net Framework 2.0 (Microsoft)
• Microsoft .net Framework 3.0 (Microsoft)
• Microsoft .net Framework 3.5 (Microsoft)
• Microsoft .net Framework 3.5.1 (Microsoft)
• Microsoft .net Framework 3.5 And 4.7.2 On Windows 10 Version 1809 For 32-bit Systems (Microsoft)
• Microsoft .net Framework 3.5 And 4.7.2 On Windows 10 Version 1809 For X64-based Systems (Microsoft)
• Microsoft .net Framework 3.5 And 4.7.2 On Windows Server 2019 (Microsoft)
• Microsoft .net Framework 3.5 And 4.7.2 On Windows Server 2019 Server Core Installation (Microsoft)
• Microsoft .net Framework 3.5 And 4.8 On Windows 10 Version 1809 For 32-bit Systems (Microsoft)
• Microsoft .net Framework 3.5 And 4.8 On Windows 10 Version 1809 For X64-based Systems (Microsoft)
• Microsoft .net Framework 3.5 And 4.8 On Windows 10 Version 1903 For 32-bit Systems (Microsoft)
• Microsoft .net Framework 3.5 And 4.8 On Windows 10 Version 1903 For X64-based Systems (Microsoft)
• Microsoft .net Framework 3.5 And 4.8 On Windows Server (Microsoft)
• Microsoft .net Framework 3.5 And 4.8 On Windows Server 2019 (Microsoft)
• Microsoft .net Framework 3.5 And 4.8 On Windows Server 2019 Server Core Installation (Microsoft)
• Microsoft .net Framework 4.5.2 (Microsoft)
• Microsoft .net Framework 4.6 (Microsoft)
• Microsoft .net Framework 4.64.6.14.6.2 (Microsoft)
• Microsoft .net Framework 4.64.6.14.6.24.74.7.14.7.2 (Microsoft)
• Microsoft .net Framework 4.8 On Windows 10 Version 1607 For 32-bit Systems (Microsoft)
• Microsoft .net Framework 4.8 On Windows 10 Version 1607 For X64-based Systems (Microsoft)
• Microsoft .net Framework 4.8 On Windows 10 Version 1703 For 32-bit Systems (Microsoft)
• Microsoft .net Framework 4.8 On Windows 10 Version 1703 For X64-based Systems (Microsoft)
• Microsoft .net Framework 4.8 On Windows 10 Version 1709 For 32-bit Systems (Microsoft)
• Microsoft .net Framework 4.8 On Windows 10 Version 1709 For X64-based Systems (Microsoft)
• Microsoft .net Framework 4.8 On Windows 10 Version 1803 For 32-bit Systems (Microsoft)
• Microsoft .net Framework 4.8 On Windows 10 Version 1803 For X64-based Systems (Microsoft)
• Microsoft .net Framework 4.8 On Windows 7 For 32-bit Systems Service Pack 1 (Microsoft)
• Microsoft .net Framework 4.8 On Windows 7 For X64-based Systems Service Pack 1 (Microsoft)
• Microsoft .net Framework 4.8 On Windows 8.1 For 32-bit Systems (Microsoft)
• Microsoft .net Framework 4.8 On Windows 8.1 For X64-based Systems (Microsoft)
• Microsoft .net Framework 4.8 On Windows Rt 8.1 (Microsoft)
• Microsoft .net Framework 4.8 On Windows Server (Microsoft)
• Microsoft .net Framework 4.8 On Windows Server 2008 R2 For X64-based Systems Service Pack 1 (Microsoft)
• Microsoft .net Framework 4.8 On Windows Server 2008 R2 For X64-based Systems Service Pack 1 Server Core Installation (Microsoft)
• Microsoft .net Framework 4.8 On Windows Server 2012 (Microsoft)
• Microsoft .net Framework 4.8 On Windows Server 2012 R2 (Microsoft)
• Microsoft .net Framework 4.8 On Windows Server 2012 R2 Server Core Installation (Microsoft)
• Microsoft .net Framework 4.8 On Windows Server 2012 Server Core Installation (Microsoft)
• Microsoft .net Framework 4.8 On Windows Server 2016 (Microsoft)
• Microsoft .net Framework 4.8 On Windows Server 2016 Server Core Installation (Microsoft)
• Microsoft Sharepoint Enterprise Server (Microsoft)
• Microsoft Sharepoint Foundation (Microsoft)
• Microsoft Sharepoint Server (Microsoft)
• Sharepoint Enterprise Server (Microsoft)
• Sharepoint Foundation (Microsoft)
• Sharepoint Server (Microsoft)
• Version 1803 Server Core Installation (Microsoft)
• Version 1903 Server Core Installation (Microsoft)
• Windows (Microsoft)
• Windows 10 (Microsoft)
• Windows 10 Version 1903 For 32-bit Systems (Microsoft)
• Windows 10 Version 1903 For Arm64-based Systems (Microsoft)
• Windows 10 Version 1903 For X64-based Systems (Microsoft)
• Windows 7 (Microsoft)
• Windows 8.1 (Microsoft)
• Windows Rt 8.1 (Microsoft)
• Windows Server (Microsoft)
• Windows Server 2008 (Microsoft)
• Windows Server 2012 (Microsoft)
• Windows Server 2016 (Microsoft)
• Windows Server 2019 (Microsoft)

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1006