full-disclosure - Re: [FD] CVE-2014-6412

Open Source and information security mailing list archives

Message-ID: <CAO_YWRWY=7=GS7bAdkueZ9ZJV4ABU5N8WP7OgZmyqJNPk1X3xg@mail.gmail.com>
Date: Thu, 12 Feb 2015 01:13:40 +0000
From: Paul McMillan <paul@...illan.ws>
To: Scott Arciszewski <scott@...iszewski.me>
Cc: fulldisclosure@...lists.org
Subject: Re: [FD] CVE-2014-6412 - WordPress (all versions) lacks CSPRNG

Seen this?

https://github.com/altf4/untwister

http://www.irongeek.com/i.php?page=videos/bsideslasvegas2014/bg04-untwisting-the-mersenne-twister-how-i-killed-the-prng-moloch

-Paul

On Tue, Feb 10, 2015 at 4:50 PM, Scott Arciszewski <scott@...iszewski.me> wrote:
> Ticket opened: 2014-06-25
> Affected Versions: ALL
> Problem: No CSPRNG
> Patch available, collecting dust because of negligent (and questionably
> competent) WP maintainers
>
> On June 25, 2014 I opened a ticked on WordPress's issue tracker to expose a
> cryptographically secure pseudorandom number generator, since none was
> present (although it looks like others have tried to hack together a
> band-aid solution to mitigate php_mt_seed until WordPress gets their "let's
> support PHP < 5.3" heads out of their asses).
>
> For the past 8 months, I have tried repeatedly to raise awareness of this
> bug, even going as far as to attend WordCamp Orlando to troll^H advocate
> for its examination in person. And they blew me off every time.
>
> If anyone with RNG breaking experience (cough solar designer cough) can PoC
> it, without the patch I've provided you should be able to trivially predict
> the password reset token for admin users and take over any WordPress site
> completely.
>
> Eight fucking months.
>
> Patch available with unit tests and PHP 5.2 on Windows support at
> https://core.trac.wordpress.org/attachment/ticket/28633/28633.3.patch
>
> Scott
> https://scott.arciszewski.me
> @voodooKobra
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> https://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives