OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
[SA25306] PHP SOAP Extension HTTP Authentication Weak Nonce

From: Secunia Security Advisories (sec-advsecunia.com)
Date: Wed May 16 2007 - 13:32:04 CDT

----------------------------------------------------------------------

Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.

The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/

The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.

----------------------------------------------------------------------

TITLE:
PHP SOAP Extension HTTP Authentication Weak Nonce

SECUNIA ADVISORY ID:
SA25306

VERIFY ADVISORY:
http://secunia.com/advisories/25306/

CRITICAL:
Less critical

IMPACT:
Security Bypass, Brute force

WHERE:
From remote

SOFTWARE:
PHP 5.2.x
http://secunia.com/product/13446/

DESCRIPTION:
Stefan Esser has reported a weakness in PHP, which can be exploited
by malicious people to bypass certain security restrictions.

The weakness is caused due to the use of an uninitialized variable
within the function "make_http_soap_request()" of the SOAP extension
when calling "php_rand_r()" to generate the nonce for the digest
authentication, which may result in a weak and predictable nonce.

SOLUTION:
Fixed in the CVS repository.
http://cvs.php.net/viewvc.cgi/php-src/ext/soap/php_http.c?r1=1.77.2.11.2.8&r2=1.77.2.11.2.9

PROVIDED AND/OR DISCOVERED BY:
Stefan Esser

ORIGINAL ADVISORY:
PHP CVS Commit:
http://cvs.php.net/viewvc.cgi/php-src/ext/soap/php_http.c?r1=1.77.2.11.2.8&r2=1.77.2.11.2.9

Stefan Esser:
http://blog.php-security.org/archives/80-Watching-the-PHP-CVS.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------