Actu
Vigil@nce - Symfony: predictability of random number
January 2016 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can predict a random in Symfony, in order to bypass
some security features.
– Impacted products: Symfony.
– Severity: 1/4.
– Creation date: 14/01/2016.
– Revision date: 18/01/2016.
DESCRIPTION OF THE VULNERABILITY
The Symfony product uses random numbers for various security
features
The Symfony/Component/Security/Core/Util/SecureRandom.php file
implements a random generator. However, on installations without
PHP 7 (random_bytes()) and without OpenSSL
(openssl_random_pseudo_bytes()), the random is generated with
uniqid() and mt_rand(), which are potentially predictable.
An attacker can therefore predict a random in Symfony, in order to
bypass some security features.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Symfony-predictability-of-random-number-18730
