|
PHP SOAP Extension HTTP Authentication Weak Nonce
|
|
|
|
|
Secunia Advisory:
|
SA25306
|
|
|
Release Date:
|
2007-05-16
|
|
Last Update:
|
2007-05-22
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Security Bypass
Brute force
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Workaround
|
|
| Software: | PHP 5.2.x
|
| | CVE reference: | CVE-2007-2728 (Secunia mirror)
|
|
|
|
|
|
Description:
Stefan Esser has reported a weakness in PHP, which can be exploited by malicious people to bypass certain security restrictions.
The weakness is caused due to the use of an uninitialized variable within the function "make_http_soap_request()" of the SOAP extension when calling "php_rand_r()" to generate the nonce for the digest authentication, which may result in a weak and predictable nonce.
Solution:
Fixed in the CVS repository.
http://cvs.php.net/viewvc.cgi/php-src...r1=1.77.2.11.2.8&r2=1.77.2.11.2.9
Provided and/or discovered by:
Stefan Esser
Changelog:
2007-05-22: Added CVE reference.
Original Advisory:
PHP CVS Commit:
http://cvs.php.net/viewvc.cgi/php-src...r1=1.77.2.11.2.8&r2=1.77.2.11.2.9
Stefan Esser:
http://blog.php-security.org/archives/80-Watching-the-PHP-CVS.html
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
18 Related Secunia Security Advisories, displaying 10
|
|
|
1. PHP Multiple Vulnerabilities
|
|
2. PHP Multiple Vulnerabilities
|
|
3. PHP COM Objects Security Bypass
|
|
4. PHP Multiple Vulnerabilities
|
|
5. PHP "glob()" Code Execution Vulnerability
|
|
6. PHP Multiple Extensions Buffer Overflow Vulnerabilities
|
|
7. PHP Integer Overflow Vulnerability and Security Bypass
|
|
8. PHP crypt() Race Condition Vulnerability
|
|
9. PHP "gdPngReadData()" Truncated PNG Data Denial of Service
|
|
10. PHP Multiple Vulnerabilities
|
Show all related advisories
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
