Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:68391
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.175 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CA+p1Tcasmon381fb22gOJ1J1Od4q3DjxRDXOH+j_6fjGyMG4Mg@mail.gmail.com>
References: <CAJRMtAGcN-n9wv8-CFiLt+bXhMvOcmfG8a3kBORVUVCz9n4Bqw@mail.gmail.com>
 <50364644.1060302@lerdorf.com> <CAJRMtAH=-B8+M6+kMrpKQZ=Yg2ASa5iv=JCUbjvHkw0UFmw73w@mail.gmail.com>
 <CAL+t6cHj4p=RLwSRGX789w-CswZQd_XtuL364KRBsc66ROdmJA@mail.gmail.com>
 <CAGa2bXY2+kDx32evFmFqUD3P1L6x=PypnVJTuj_mP2853QWQKw@mail.gmail.com>
 <5039D249.30707@sugarcrm.com> <CAGa2bXZso_S3fOUogqMwiTYJKtK3KZH5Fs8GZApxMnT+DwgpbQ@mail.gmail.com>
 <CAGa2bXauBFja+BJcLxiE5t5rnfna1QDt3iTRdYr04a1ExFz7+A@mail.gmail.com>
 <503A968A.4070206@sugarcrm.com> <CAGa2bXaMYxD3-mbATK0WfEryVEvjHE8m2RnujTauLN8t1S+H6w@mail.gmail.com>
 <CAGa2bXZ3pYiO5Lfn5NS-vuPBk_X6SUsr6Qsswya6mx0S3SjgeQ@mail.gmail.com>
 <CAGa2bXY-+B-_-3N2=VYy7rJB-eXF0nzrGA-eSJmM+O87qDrx-Q@mail.gmail.com>
 <51FEEEAF.1070705@sugarcrm.com> <51FEF5AA.5060409@sugarcrm.com>
 <CAGa2bXY0f+vveuRi5hbtfk2d2jn80zAwg0611nqEHXuzNJXBWA@mail.gmail.com>
 <CA+p1TcaEth-KAQEdm9vufs5urky00DBqg1Lg2yHibErb1vWrrw@mail.gmail.com>
 <CAGa2bXbYgQ1wVUQOq1=0MQQ7g7V+UonLFmMO5vQCJxTDFsLRkA@mail.gmail.com>
 <CA+p1TcaQtT3nm+rqhArfu0AFsNBTr2u_-KXjd6A2E6HVj2r_tQ@mail.gmail.com>
 <CAGa2bXb50teO0UgpsNdwWdCkv=+2MAJAw0VLfPu0T9dDRbU1ZA@mail.gmail.com>
 <CA+p1TcZ=eRmJLcGS430rrA_r6xOFvgj18dqVb5_zJQy0_TiEVw@mail.gmail.com>
 <CAGa2bXY-u8SDqeQpLuZY4yfej3VMWnF11FW+1m4Lnh3r9CUUkw@mail.gmail.com>
 <CA+p1Tcb8umQgn34bYsZL=UTGGPu3cNaaDT2zbNBDsHRrkQq-rg@mail.gmail.com>
 <CAGa2bXZJFapauPMWP7Rcmh5A5gLyjVGvKyrcXgoT_JJjsG=GBw@mail.gmail.com> <CA+p1Tcasmon381fb22gOJ1J1Od4q3DjxRDXOH+j_6fjGyMG4Mg@mail.gmail.com>
Date: Tue, 6 Aug 2013 04:41:29 +0900
Message-ID: <CAGa2bXZZwFj3QRtxDWMcm63i5PwLF83Qwfp5r8gC1-2pXaX+Eg@mail.gmail.com>
To: Arpad Ray <arraypad@gmail.com>
Cc: Stas Malyshev <smalyshev@sugarcrm.com>, PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=14dae93d8ede12184e04e3388184
Subject: Re: [PHP-DEV] Session Id Collisions
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--14dae93d8ede12184e04e3388184
Content-Type: text/plain; charset=UTF-8

Hi Arpad,

On Tue, Aug 6, 2013 at 4:17 AM, Arpad Ray <arraypad@gmail.com> wrote:

> On Mon, Aug 5, 2013 at 7:46 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>
>> On Tue, Aug 6, 2013 at 1:04 AM, Arpad Ray <arraypad@gmail.com> wrote:
>>
>>>  I think there really should be a vote.
>>
>>
>> This means you don't really understand the true risk of this
>> vulnerability.
>> It allows permanent session ID fixation. This is CVE assigned
>> vulnerability.
>> Details are explained in the RFC and I don't want to explain fully in ML
>> again.
>> (We might discussed the details in security@php.net, but I think I wrote
>> enough info)
>>
>> Please refer to the RFC.
>>
>
> I do really understand the risk...
>

It allows "permanent" session ID fixation due to browser implementations.
To make matter worse than old days, recent browsers only send one
outstanding cookie. This made attack detection impossible at server side.
(i.e. bad countermeasure(?) took by browser developers)

If you curious about this vulnerability fix still, please read the RFC and
do a little experiments. I did the experiment 2 years ago (and even 10 years
ago). I suppose things are not changed.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--14dae93d8ede12184e04e3388184--