bugtraq - Claroline 1.7.2, sso identification vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 20 Jan 2006 17:27:26 -0000
From: karmaguedon@...mail.com
To: bugtraq@...urityfocus.com
Subject: Claroline 1.7.2, sso identification vulnerability


hi,
this is what we can read in file "/claroline/inc/claro_init_local.inc.php" :

[...]
$ssoCookieValue      = md5( mktime() );

                $sql = "UPDATE `".$tbl_sso."`
                        SET cookie    = '".$ssoCookieValue."',
                            rec_time  = NOW()
                        WHERE user_id = ". (int) $_uid;

                $affectedRowCount = claro_sql_query_affected_rows($sql);

                if ($affectedRowCount < 1)
                {
                    $sql = "INSERT INTO `".$tbl_sso."`
                            SET cookie    = '".$ssoCookieValue."',
                                rec_time  = NOW(),
                                user_id   = ". (int) $_uid;

                    claro_sql_query($sql);
                }

               $boolCookie = setcookie($ssoCookieName, $ssoCookieValue,
                                       $ssoCookieExpireTime,
                                       $ssoCookiePath, $ssoCookieDomain);
[...]

so, the cookie value must be always unknown.
in this code, the cookie value is the md5 value of the connection time ! really unknown ? no.

solution :
desactivate sso service
or
replace mktime() by rand(100,1000000) (for e.g)