Re: Advisory: Weak RNG in PHP session ID generation leads to session hijacking

[Pierre Pronchery <pierre.pronchery () duekin com>]

                        Dear Andreas, list,

On 2010-03-29, Andreas Bogk <andreas () andreas org> wrote:
> PHP session ID generation uses RNG with weak properties
>
> A PHP site becomes vulnerable to the attack described below if it
> meets the follogin requirements:
>
>  * It uses the standard PHP session mechanism
>  * It provides access to the output of the uniqid() function, with
>    'more_entropy' set to 'true'.
>  * It uses some mechanism to persist the PHP interpreter, such as FCGI.
>  * It discloses login status and remote address of users

Sometimes there is no need to know the remote address of users. As far
as I could observe, if there is some kind of load-balancer or
reverse-proxy in front of PHP, then the remote address injected in the
session ID hash may be static and predictable.

Obtaining it once may then be enough to run the attack, even increasing
the chances for success: it is then possible to attack users at
random. The more users there are, the more practical it gets...

HTH,
-- 
Pierre Pronchery, security consultant, DUEKIN Consulting
email: pierre.pronchery () duekin com     Gubener Straße 40
PGP:   36F0 CA45 CA07 C871 8E31        10243 Berlin, Germany
       6FC4 6BBE DBA9 02A0 E77E        Web:   http://www.duekin.com/
Phone: +49 177 472 7481                Phone: +49 30 420 81 859
                                       Fax:   +49 30 420 81 861

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/