oss-sec mailing list archives
Re: Debian/Ubuntu php_crypt_revamped.patch
From: Solar Designer <solar () openwall com>
Date: Fri, 4 May 2012 21:35:28 +0400
On Fri, May 04, 2012 at 10:08:53AM -0600, Kurt Seifried wrote:
So I'm guessing this needs a CVE #?
The purpose of my posting wasn't to request a CVE id (although you may provide one), but rather to notify Ubuntu and others of the Debian bug that they may need to fix in Debian-derived distros, and to suggest that the patch be dropped from future versions. Speaking of CVE, though, I think that yes - this deserves one. This is a security issue in two ways: 1. User authentication in some PHP apps may turn from fail-close to fail-open. 2. If a PHP app actually makes use of PHP crypt()'s ability to generate random salts (when no salt is provided), then empty strings may be generated in place of hashed passwords for newly set/changed passwords. Combined with #1 above, this may mean that authentication with any password will then succeed against such accounts. Since I expect that Ubuntu will fix this in a PHP update for 11.04, I guess they'll want to refer to a CVE id in the advisory. Thanks, Alexander
Current thread:
- Debian/Ubuntu php_crypt_revamped.patch Solar Designer (May 04)
- Re: Debian/Ubuntu php_crypt_revamped.patch Kurt Seifried (May 04)
- Re: Debian/Ubuntu php_crypt_revamped.patch Solar Designer (May 04)
- Re: Debian/Ubuntu php_crypt_revamped.patch Daniel Kahn Gillmor (May 04)
- Re: Debian/Ubuntu php_crypt_revamped.patch Michael Gilbert (May 04)
- Re: Debian/Ubuntu php_crypt_revamped.patch Kurt Seifried (May 05)
- Re: Debian/Ubuntu php_crypt_revamped.patch Solar Designer (May 04)
- Re: Debian/Ubuntu php_crypt_revamped.patch Kurt Seifried (May 04)