Vulnerabilities > CVE-2016-1902 - Cryptographic Issues vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

debian

sensiolabs

CWE-310

nessus

NVD

Published: 2016-06-01

Updated: 2016-06-03

Summary

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.

Vulnerable Configurations

Part	Description	Count
OS	Debian Debian Debian Linux 8.0	1
Application	Sensiolabs Sensiolabs Symfony 2.7.5 Sensiolabs Symfony 2.7.4 Sensiolabs Symfony 2.7.7 Sensiolabs Symfony 2.7.1 Sensiolabs Symfony 2.6.1 Sensiolabs Symfony 2.7.8 Sensiolabs Symfony 2.6.5 Sensiolabs Symfony 2.6.11 Sensiolabs Symfony 2.6.3 Sensiolabs Symfony 2.6.8 Sensiolabs Symfony 2.6.10 Sensiolabs Symfony 2.7.0 Sensiolabs Symfony 2.7.3 Sensiolabs Symfony 2.6.4 Sensiolabs Symfony 2.6.6 Sensiolabs Symfony 2.6.7 Sensiolabs Symfony 2.7.2 Sensiolabs Symfony 2.6.0 Sensiolabs Symfony 2.7.6 Sensiolabs Symfony 1.4.0 Sensiolabs Symfony 1.4.1 Sensiolabs Symfony 1.4.2 Sensiolabs Symfony 1.4.3 Sensiolabs Symfony 1.4.4 Sensiolabs Symfony 1.4.5 Sensiolabs Symfony 1.4.6 Sensiolabs Symfony 1.4.7 Sensiolabs Symfony 1.4.8 Sensiolabs Symfony 1.4.9 Sensiolabs Symfony 1.4.10 Sensiolabs Symfony 1.4.11 Sensiolabs Symfony 1.4.12 Sensiolabs Symfony 1.4.13 Sensiolabs Symfony 1.4.14 Sensiolabs Symfony 1.4.15 Sensiolabs Symfony 1.4.16 Sensiolabs Symfony 1.4.17 Sensiolabs Symfony 1.4.18 Sensiolabs Symfony 1.4.19 Sensiolabs Symfony 2.0.0 Sensiolabs Symfony 2.0.1 Sensiolabs Symfony 2.0.2 Sensiolabs Symfony 2.0.3 Sensiolabs Symfony 2.0.4 Sensiolabs Symfony 2.0.5 Sensiolabs Symfony 2.0.6 Sensiolabs Symfony 2.0.7 Sensiolabs Symfony 2.0.8 Sensiolabs Symfony 2.0.9 Sensiolabs Symfony 2.0.10 Sensiolabs Symfony 2.0.11 Sensiolabs Symfony 2.0.12 Sensiolabs Symfony 2.0.13 Sensiolabs Symfony 2.0.14 Sensiolabs Symfony 2.0.15 Sensiolabs Symfony 2.0.16 Sensiolabs Symfony 2.0.17 Sensiolabs Symfony 2.0.18 Sensiolabs Symfony 2.0.19 Sensiolabs Symfony 2.0.20 Sensiolabs Symfony 2.0.21 Sensiolabs Symfony 2.0.22 Sensiolabs Symfony 2.0.23 Sensiolabs Symfony 2.0.24 Sensiolabs Symfony 2.0.25 Sensiolabs Symfony 2.1.0 Sensiolabs Symfony 2.1.1 Sensiolabs Symfony 2.1.2 Sensiolabs Symfony 2.1.3 Sensiolabs Symfony 2.1.4 Sensiolabs Symfony 2.1.5 Sensiolabs Symfony 2.1.6 Sensiolabs Symfony 2.1.7 Sensiolabs Symfony 2.1.8 Sensiolabs Symfony 2.1.9 Sensiolabs Symfony 2.1.10 Sensiolabs Symfony 2.1.11 Sensiolabs Symfony 2.1.12 Sensiolabs Symfony 2.1.13 Sensiolabs Symfony 2.2.0 Sensiolabs Symfony 2.2.1 Sensiolabs Symfony 2.2.2 Sensiolabs Symfony 2.2.3 Sensiolabs Symfony 2.2.4 Sensiolabs Symfony 2.2.5 Sensiolabs Symfony 2.2.6 Sensiolabs Symfony 2.2.7 Sensiolabs Symfony 2.2.8 Sensiolabs Symfony 2.2.9 Sensiolabs Symfony 2.2.10 Sensiolabs Symfony 2.2.11 Sensiolabs Symfony 2.3.0 Sensiolabs Symfony 2.3.1 Sensiolabs Symfony 2.3.2 Sensiolabs Symfony 2.3.3 Sensiolabs Symfony 2.3.4 Sensiolabs Symfony 2.3.5 Sensiolabs Symfony 2.3.6 Sensiolabs Symfony 2.3.7 Sensiolabs Symfony 2.3.8 Sensiolabs Symfony 2.3.9 Sensiolabs Symfony 2.3.10 Sensiolabs Symfony 2.3.11 Sensiolabs Symfony 2.3.12 Sensiolabs Symfony 2.3.13 Sensiolabs Symfony 2.3.14 Sensiolabs Symfony 2.3.15 Sensiolabs Symfony 2.3.16 Sensiolabs Symfony 2.3.17 Sensiolabs Symfony 2.3.18 Sensiolabs Symfony 2.3.19 Sensiolabs Symfony 2.3.20 Sensiolabs Symfony 2.3.21 Sensiolabs Symfony 2.3.22 Sensiolabs Symfony 2.3.23 Sensiolabs Symfony 2.3.24 Sensiolabs Symfony 2.3.25 Sensiolabs Symfony 2.3.26 Sensiolabs Symfony 2.3.27 Sensiolabs Symfony 2.3.28 Sensiolabs Symfony 2.3.29 Sensiolabs Symfony 2.3.30 Sensiolabs Symfony 2.3.31 Sensiolabs Symfony 2.3.32 Sensiolabs Symfony 2.3.33 Sensiolabs Symfony 2.3.34 Sensiolabs Symfony 2.3.35 Sensiolabs Symfony 2.3.36 Sensiolabs Symfony 2.6.9 Sensiolabs Symfony 2.6.2 Sensiolabs Symfony 2.6.12	144

Common Weakness Enumeration (CWE)

CWE-310 - Cryptographic Issues

Common Attack Pattern Enumeration and Classification (CAPEC)

Signature Spoofing by Key Recreation
An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Nessus

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-3588.NASL
description	Two vulnerabilities were discovered in Symfony, a PHP framework. - CVE-2016-1902 Lander Brandt discovered that the class SecureRandom might generate weak random numbers for cryptographic use under certain settings. If the functions random_bytes() or openssl_random_pseudo_bytes() are not available, the output of SecureRandom should not be consider secure. - CVE-2016-4423 Marek Alaksa from Citadelo discovered that it is possible to fill up the session storage space by submitting inexistent large usernames.
last seen	2020-06-01
modified	2020-06-02
plugin id	91365
published	2016-05-31
reporter	This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/91365
title	Debian DSA-3588-1 : symfony - security update

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

References