full-disclosure - Re: Advisory: Weak RNG in PHP session ID generation leads to session hijacking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <slrn3vfshr8n2f.c15.khorben@kwarx.defora.lan>
Date: Thu, 1 Apr 2010 08:41:51 +0000 (UTC)
From: Pierre Pronchery <pierre.pronchery@...kin.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Advisory: Weak RNG in PHP session ID
 generation leads to session hijacking

			Dear Andreas, list,

On 2010-03-29, Andreas Bogk <andreas@...reas.org> wrote:
> PHP session ID generation uses RNG with weak properties
>
> A PHP site becomes vulnerable to the attack described below if it
> meets the follogin requirements:
>
>  * It uses the standard PHP session mechanism
>  * It provides access to the output of the uniqid() function, with
>    'more_entropy' set to 'true'.
>  * It uses some mechanism to persist the PHP interpreter, such as FCGI.
>  * It discloses login status and remote address of users

Sometimes there is no need to know the remote address of users. As far
as I could observe, if there is some kind of load-balancer or
reverse-proxy in front of PHP, then the remote address injected in the
session ID hash may be static and predictable.

Obtaining it once may then be enough to run the attack, even increasing
the chances for success: it is then possible to attack users at
random. The more users there are, the more practical it gets...

HTH,
-- 
Pierre Pronchery, security consultant, DUEKIN Consulting
email: pierre.pronchery@...kin.com     Gubener Straße 40
PGP:   36F0 CA45 CA07 C871 8E31        10243 Berlin, Germany
       6FC4 6BBE DBA9 02A0 E77E        Web:   http://www.duekin.com/
Phone: +49 177 472 7481                Phone: +49 30 420 81 859
                                       Fax:   +49 30 420 81 861

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/