ID CVE-2010-1128
Summary The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function.
References
Vulnerable Configurations
  • PHP 5.2.12
    cpe:2.3:a:php:php:5.2.12
  • PHP 5.2.11
    cpe:2.3:a:php:php:5.2.11
  • PHP 5.2.10
    cpe:2.3:a:php:php:5.2.10
  • PHP 5.2.1
    cpe:2.3:a:php:php:5.2.1
  • PHP 5.2.9
    cpe:2.3:a:php:php:5.2.9
  • PHP 5.2.8
    cpe:2.3:a:php:php:5.2.8
  • PHP 5.2.7
    cpe:2.3:a:php:php:5.2.7
  • PHP 5.2.6
    cpe:2.3:a:php:php:5.2.6
  • PHP 5.2.5
    cpe:2.3:a:php:php:5.2.5
  • PHP 5.2.4
    cpe:2.3:a:php:php:5.2.4
  • PHP 5.2.3
    cpe:2.3:a:php:php:5.2.3
  • PHP 5.2.2
    cpe:2.3:a:php:php:5.2.2
  • PHP 5.2.0
    cpe:2.3:a:php:php:5.2.0
CVSS
Base: 6.4 (as of 29-03-2010 - 16:33)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL NONE
exploit-db via4
description PHP 5.3.1 LCG Entropy Security Vulnerability. CVE-2010-1128. Dos exploit for php platform
id EDB-ID:33677
last seen 2016-02-03
modified 2010-02-26
published 2010-02-26
reporter Rasmus
source https://www.exploit-db.com/download/33677/
title PHP <= 5.3.1 - LCG Entropy Security Vulnerability
nessus via4
  • NASL family CGI abuses
    NASL id PHP_5_2_13.NASL
    description According to its banner, the version of PHP installed on the remote host is older than 5.3.2 / 5.2.13. Such versions may be affected by several security issues : - Directory paths not ending with '/' may not be correctly validated inside 'tempnam()' in 'safe_mode' configuration. - It may be possible to bypass the 'open_basedir'/ 'safe_mode' configuration restrictions due to an error in session extensions. - An unspecified vulnerability affects the LCG entropy.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 44921
    published 2010-02-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=44921
    title PHP < 5.3.2 / 5.2.13 Multiple Vulnerabilities
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2010-058.NASL
    description Multiple vulnerabilities has been found and corrected in php : - Improved LCG entropy. (Rasmus, Samy Kamkar) (CVE-2010-1128) - Fixed safe_mode validation inside tempnam() when the directory path does not end with a /). (Martin Jansen) (CVE-2010-1129) - Fixed a possible open_basedir/safe_mode bypass in the session extension identified by Grzegorz Stachowiak. (Ilia) (CVE-2010-1130) Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers. The updated packages have been patched to correct these issues.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 45029
    published 2010-03-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=45029
    title Mandriva Linux Security Advisory : php (MDVSA-2010:058)
  • NASL family CGI abuses
    NASL id PHP_5_3_1.NASL
    description According to its banner, the version of PHP 5.3 installed on the remote host is older than 5.3.1. Such versions may be affected by several security issues : - Sanity checks are missing in exif processing. - It is possible to bypass the 'safe_mode' configuration setting using 'tempnam()'. - It is possible to bypass the 'open_basedir' configuration setting using 'posix_mkfifo()'. - The 'safe_mode_include_dir' configuration setting may be ignored. (Bug #50063) - Calling 'popen()' with an invalid mode can cause a crash under Windows. (Bug #44683) - Provided file uploading is enabled (it is by default), an attacker can upload files using a POST request with 'multipart/form-data' content even if the target script doesn't actually support file uploads per se. By supplying a large number (15,000+) of files, an attacker could cause the web server to stop responding while it processes the file list. - 'proc_open()' can bypass 'safe_mode_protected_env_vars'. (Bug #49026) - An unspecified vulnerability affects the LCG entropy.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 42862
    published 2009-11-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=42862
    title PHP 5.3 < 5.3.1 Multiple Vulnerabilities
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2010-0919.NASL
    description From Red Hat Security Advisory 2010:0919 : Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. An input validation flaw was discovered in the PHP session serializer. If a PHP script generated session variable names from untrusted user input, a remote attacker could use this flaw to inject an arbitrary variable into the PHP session. (CVE-2010-3065) An information leak flaw was discovered in the PHP var_export() function implementation. If some fatal error occurred during the execution of this function (such as the exhaustion of memory or script execution time limit), part of the function's output was sent to the user as script output, possibly leading to the disclosure of sensitive information. (CVE-2010-2531) A numeric truncation error and an input validation flaw were found in the way the PHP utf8_decode() function decoded partial multi-byte sequences for some multi-byte encodings, sending them to output without them being escaped. An attacker could use these flaws to perform a cross-site scripting attack. (CVE-2009-5016, CVE-2010-3870) It was discovered that the PHP lcg_value() function used insufficient entropy to seed the pseudo-random number generator. A remote attacker could possibly use this flaw to predict values returned by the function, which are used to generate session identifiers by default. This update changes the function's implementation to use more entropy during seeding. (CVE-2010-1128) It was discovered that the PHP fnmatch() function did not restrict the length of the pattern argument. A remote attacker could use this flaw to crash the PHP interpreter where a script used fnmatch() on untrusted matching patterns. (CVE-2010-1917) A NULL pointer dereference flaw was discovered in the PHP XML-RPC extension. A malicious XML-RPC client or server could use this flaw to crash the PHP interpreter via a specially crafted XML-RPC request. (CVE-2010-0397) All php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 68150
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=68150
    title Oracle Linux 4 / 5 : php (ELSA-2010-0919)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2010-0919.NASL
    description Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. An input validation flaw was discovered in the PHP session serializer. If a PHP script generated session variable names from untrusted user input, a remote attacker could use this flaw to inject an arbitrary variable into the PHP session. (CVE-2010-3065) An information leak flaw was discovered in the PHP var_export() function implementation. If some fatal error occurred during the execution of this function (such as the exhaustion of memory or script execution time limit), part of the function's output was sent to the user as script output, possibly leading to the disclosure of sensitive information. (CVE-2010-2531) A numeric truncation error and an input validation flaw were found in the way the PHP utf8_decode() function decoded partial multi-byte sequences for some multi-byte encodings, sending them to output without them being escaped. An attacker could use these flaws to perform a cross-site scripting attack. (CVE-2009-5016, CVE-2010-3870) It was discovered that the PHP lcg_value() function used insufficient entropy to seed the pseudo-random number generator. A remote attacker could possibly use this flaw to predict values returned by the function, which are used to generate session identifiers by default. This update changes the function's implementation to use more entropy during seeding. (CVE-2010-1128) It was discovered that the PHP fnmatch() function did not restrict the length of the pattern argument. A remote attacker could use this flaw to crash the PHP interpreter where a script used fnmatch() on untrusted matching patterns. (CVE-2010-1917) A NULL pointer dereference flaw was discovered in the PHP XML-RPC extension. A malicious XML-RPC client or server could use this flaw to crash the PHP interpreter via a specially crafted XML-RPC request. (CVE-2010-0397) All php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 50841
    published 2010-11-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=50841
    title RHEL 4 / 5 : php (RHSA-2010:0919)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2010-0919.NASL
    description Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. An input validation flaw was discovered in the PHP session serializer. If a PHP script generated session variable names from untrusted user input, a remote attacker could use this flaw to inject an arbitrary variable into the PHP session. (CVE-2010-3065) An information leak flaw was discovered in the PHP var_export() function implementation. If some fatal error occurred during the execution of this function (such as the exhaustion of memory or script execution time limit), part of the function's output was sent to the user as script output, possibly leading to the disclosure of sensitive information. (CVE-2010-2531) A numeric truncation error and an input validation flaw were found in the way the PHP utf8_decode() function decoded partial multi-byte sequences for some multi-byte encodings, sending them to output without them being escaped. An attacker could use these flaws to perform a cross-site scripting attack. (CVE-2009-5016, CVE-2010-3870) It was discovered that the PHP lcg_value() function used insufficient entropy to seed the pseudo-random number generator. A remote attacker could possibly use this flaw to predict values returned by the function, which are used to generate session identifiers by default. This update changes the function's implementation to use more entropy during seeding. (CVE-2010-1128) It was discovered that the PHP fnmatch() function did not restrict the length of the pattern argument. A remote attacker could use this flaw to crash the PHP interpreter where a script used fnmatch() on untrusted matching patterns. (CVE-2010-1917) A NULL pointer dereference flaw was discovered in the PHP XML-RPC extension. A malicious XML-RPC client or server could use this flaw to crash the PHP interpreter via a specially crafted XML-RPC request. (CVE-2010-0397) All php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 50862
    published 2010-12-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=50862
    title CentOS 4 / 5 : php (CESA-2010:0919)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-989-1.NASL
    description Auke van Slooten discovered that PHP incorrectly handled certain xmlrpc requests. An attacker could exploit this issue to cause the PHP server to crash, resulting in a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.04 and 9.10. (CVE-2010-0397) It was discovered that the pseudorandom number generator in PHP did not provide the expected entropy. An attacker could exploit this issue to predict values that were intended to be random, such as session cookies. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.04 and 9.10. (CVE-2010-1128) It was discovered that PHP did not properly handle directory pathnames that lacked a trailing slash character. An attacker could exploit this issue to bypass safe_mode restrictions. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.04 and 9.10. (CVE-2010-1129) Grzegorz Stachowiak discovered that the PHP session extension did not properly handle semicolon characters. An attacker could exploit this issue to bypass safe_mode restrictions. This issue only affected Ubuntu 8.04 LTS, 9.04 and 9.10. (CVE-2010-1130) Stefan Esser discovered that PHP incorrectly decoded remote HTTP chunked encoding streams. An attacker could exploit this issue to cause the PHP server to crash and possibly execute arbitrary code with application privileges. This issue only affected Ubuntu 10.04 LTS. (CVE-2010-1866) Mateusz Kocielski discovered that certain PHP SQLite functions incorrectly handled empty SQL queries. An attacker could exploit this issue to possibly execute arbitrary code with application privileges. (CVE-2010-1868) Mateusz Kocielski discovered that PHP incorrectly handled certain arguments to the fnmatch function. An attacker could exploit this flaw and cause the PHP server to consume all available stack memory, resulting in a denial of service. (CVE-2010-1917) Stefan Esser discovered that PHP incorrectly handled certain strings in the phar extension. An attacker could exploit this flaw to possibly view sensitive information. This issue only affected Ubuntu 10.04 LTS. (CVE-2010-2094, CVE-2010-2950) Stefan Esser discovered that PHP incorrectly handled deserialization of SPLObjectStorage objects. A remote attacker could exploit this issue to view sensitive information and possibly execute arbitrary code with application privileges. This issue only affected Ubuntu 8.04 LTS, 9.04, 9.10 and 10.04 LTS. (CVE-2010-2225) It was discovered that PHP incorrectly filtered error messages when limits for memory, execution time, or recursion were exceeded. A remote attacker could exploit this issue to possibly view sensitive information. (CVE-2010-2531) Stefan Esser discovered that the PHP session serializer incorrectly handled the PS_UNDEF_MARKER marker. An attacker could exploit this issue to alter arbitrary session variables. (CVE-2010-3065). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 49306
    published 2010-09-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=49306
    title Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : php5 vulnerabilities (USN-989-1)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201110-06.NASL
    description The remote host is affected by the vulnerability described in GLSA-201110-06 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker could execute arbitrary code, obtain sensitive information from process memory, bypass intended access restrictions, or cause a Denial of Service in various ways. A remote attacker could cause a Denial of Service in various ways, bypass spam detections, or bypass open_basedir restrictions. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-11
    plugin id 56459
    published 2011-10-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=56459
    title GLSA-201110-06 : PHP: Multiple vulnerabilities
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20101129_PHP_ON_SL4_X.NASL
    description An input validation flaw was discovered in the PHP session serializer. If a PHP script generated session variable names from untrusted user input, a remote attacker could use this flaw to inject an arbitrary variable into the PHP session. (CVE-2010-3065) An information leak flaw was discovered in the PHP var_export() function implementation. If some fatal error occurred during the execution of this function (such as the exhaustion of memory or script execution time limit), part of the function's output was sent to the user as script output, possibly leading to the disclosure of sensitive information. (CVE-2010-2531) A numeric truncation error and an input validation flaw were found in the way the PHP utf8_decode() function decoded partial multi-byte sequences for some multi-byte encodings, sending them to output without them being escaped. An attacker could use these flaws to perform a cross-site scripting attack. (CVE-2009-5016, CVE-2010-3870) It was discovered that the PHP lcg_value() function used insufficient entropy to seed the pseudo-random number generator. A remote attacker could possibly use this flaw to predict values returned by the function, which are used to generate session identifiers by default. This update changes the function's implementation to use more entropy during seeding. (CVE-2010-1128) It was discovered that the PHP fnmatch() function did not restrict the length of the pattern argument. A remote attacker could use this flaw to crash the PHP interpreter where a script used fnmatch() on untrusted matching patterns. (CVE-2010-1917) A NULL pointer dereference flaw was discovered in the PHP XML-RPC extension. A malicious XML-RPC client or server could use this flaw to crash the PHP interpreter via a specially crafted XML-RPC request. (CVE-2010-0397) After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 60908
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60908
    title Scientific Linux Security Update : php on SL4.x, SL5.x i386/x86_64
redhat via4
advisories
rhsa
id RHSA-2010:0919
rpms
  • php-0:4.3.9-3.31
  • php-devel-0:4.3.9-3.31
  • php-domxml-0:4.3.9-3.31
  • php-gd-0:4.3.9-3.31
  • php-imap-0:4.3.9-3.31
  • php-ldap-0:4.3.9-3.31
  • php-mbstring-0:4.3.9-3.31
  • php-mysql-0:4.3.9-3.31
  • php-ncurses-0:4.3.9-3.31
  • php-odbc-0:4.3.9-3.31
  • php-pear-0:4.3.9-3.31
  • php-pgsql-0:4.3.9-3.31
  • php-snmp-0:4.3.9-3.31
  • php-xmlrpc-0:4.3.9-3.31
  • php-0:5.1.6-27.el5_5.3
  • php-bcmath-0:5.1.6-27.el5_5.3
  • php-cli-0:5.1.6-27.el5_5.3
  • php-common-0:5.1.6-27.el5_5.3
  • php-dba-0:5.1.6-27.el5_5.3
  • php-devel-0:5.1.6-27.el5_5.3
  • php-gd-0:5.1.6-27.el5_5.3
  • php-imap-0:5.1.6-27.el5_5.3
  • php-ldap-0:5.1.6-27.el5_5.3
  • php-mbstring-0:5.1.6-27.el5_5.3
  • php-mysql-0:5.1.6-27.el5_5.3
  • php-ncurses-0:5.1.6-27.el5_5.3
  • php-odbc-0:5.1.6-27.el5_5.3
  • php-pdo-0:5.1.6-27.el5_5.3
  • php-pgsql-0:5.1.6-27.el5_5.3
  • php-snmp-0:5.1.6-27.el5_5.3
  • php-soap-0:5.1.6-27.el5_5.3
  • php-xml-0:5.1.6-27.el5_5.3
  • php-xmlrpc-0:5.1.6-27.el5_5.3
refmap via4
bid 38430
confirm
secunia
  • 38708
  • 42410
vupen
  • ADV-2010-0479
  • ADV-2010-3081
statements via4
contributor Joshua Bressers
lastmodified 2010-04-14
organization Red Hat
statement Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=577582 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/
Last major update 10-12-2010 - 01:39
Published 26-03-2010 - 16:30
Back to Top