News Feed
Jobs Feed
Sections




News Archive
Looking for more information on how to do PHP the right way? Check out PHP: The Right Way

php|architect:
Possible vulnerabilities found in PHP session IDs
April 12, 2010 @ 08:29:00

Beth Tucker Long has posted a new warning about a possible issue with session IDs in PHP dealing with weak random numbers being generated by the language when making the IDs.

Seclists.org has posted an advisory titled "Weak RNG in PHP session ID generation leads to session hijacking." RNG stands for Random Number Generation, and the advisory is warning that not enough entropy is being used to seed the RNG; this, in turn, can lead to a reduced number of possible session IDs under certain specific conditions, thus making brute force session spoofing easier, if not bringing it into the realm of feasibility.

The threat is only marked at a "medium" level of severity, but it could still cause problems if you're not careful. There are specific conditions that have to be in place for it to be a problem including using the standard PHP session generation and that the app shares the information about remote users. To protect yourself you can either install Suhosin and don't use the result of set an external source for entropy to help randomize the session ID even more.

0 comments voice your opinion now!
sessionid vulnerability rng random number entropy


blog comments powered by Disqus

Similar Posts

Symfony Blog: symfony 1.0.5 released (security fix)

Timoh's Blog: Aggressive password stretching - A solution to the low-entropy keys problem?

Greg Beaver's Blog: Update to libxml2 in PHP - progress hath been acquired

Davey Shafik\'s Blog: Zend Framework and Flickr

PHP-Coding-Practices.com: Introduction To Security Vulnerabilities In PHP


Community Events











Don't see your event here?
Let us know!


podcast code introduction threedevsandamaybe application language hhvm symfony2 security unittest performance hack package component facebook composer install database release framework

All content copyright, 2014 PHPDeveloper.org :: info@phpdeveloper.org - Powered by the Solar PHP Framework