Re: Debian/Ubuntu php_crypt_revamped.patch

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 05/04/2012 11:35 AM, Solar Designer wrote:
> On Fri, May 04, 2012 at 10:08:53AM -0600, Kurt Seifried wrote:
> > So I'm guessing this needs a CVE #?
>
> The purpose of my posting wasn't to request a CVE id (although you
> may provide one), but rather to notify Ubuntu and others of the
> Debian bug that they may need to fix in Debian-derived distros, and
> to suggest that the patch be dropped from future versions.
>
> Speaking of CVE, though, I think that yes - this deserves one.
> This is a security issue in two ways:
>
> 1. User authentication in some PHP apps may turn from fail-close
> to fail-open.
>
> 2. If a PHP app actually makes use of PHP crypt()'s ability to
> generate random salts (when no salt is provided), then empty
> strings may be generated in place of hashed passwords for newly
> set/changed passwords. Combined with #1 above, this may mean that
> authentication with any password will then succeed against such
> accounts.
>
> Since I expect that Ubuntu will fix this in a PHP update for 11.04,
> I guess they'll want to refer to a CVE id in the advisory.
>
> Thanks,
>
> Alexander

Please use CVE-2012-2317 for this issue.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJPpb3sAAoJEBYNRVNeJnmTMKYP/2xzCpV+UpDSj4TjY5nx4vzj
yp5qt2jLWvb36/mZE4QfamIcp8jARGDSQPkFQ/dY5sjn/fTpdKzBVNbFvDcHTwuu
nfsPp1owlXrqW3SPVTpUjl+FpeRIdWhYoj3H5Le2vFkWVxjwt7CmJEITU88lr3/8
fklX1RMqVEy7EPWjnLmfvO4oLa9d2FrB2R3EnYPt32zxSJZEIBIqladGIHpiJTS/
f+IuRjHvNJUODQ+Bz+Rh/CONwPXUXVqAft75FHIkAg/8SxZ2ILd5kDX7uh3quWvj
5U2TleRNEF024DWvo4yt20gvPGRH+eSTBOnZqNfjPJk6vAJutyGuMam0LnEni6ht
WSRFj78xnlBcw8BX5kYEeNviTDUGC1nN45cymEOtFrwsHlz+rJ1A0IaDNlSnmCN8
OnhWTkmLc4vq74gPc6omgd/C76xrtTEGFgFpYEY3Fl9SN3hyuW5QxYVqIFOob4RP
4X1aYFpoc1RV6ow3Q8VIy8cTqK7rPD5mME5AGBrXg0gwH94mroaVfEyNDtX6GWY7
yea9WJB5LsaSDhg4WQe7is7V0MgMFz4PHOtFWyeeNFHAadXSz8KTUqX1CJCeWY2q
6a6R7p8PTDpJnTtnXFZQKXRpqDlNXaQyNlYHCQwwjIXwLExBqvKdoBaCpezNPn6d
vR2zG4anSx0QbFTZga9Z
=8hhh
-----END PGP SIGNATURE-----