Vulnerabilities > CVE-2016-4423 - Resource Management Errors vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

sensiolabs

debian

CWE-399

nessus

NVD

Published: 2016-06-01

Updated: 2016-06-03

Summary

The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.

Vulnerable Configurations

Part	Description	Count
Application	Sensiolabs Sensiolabs Symfony 2.7.5 Sensiolabs Symfony 3.0.5 Sensiolabs Symfony 2.7.4 Sensiolabs Symfony 2.7.7 Sensiolabs Symfony 3.0.2 Sensiolabs Symfony 2.7.1 Sensiolabs Symfony 2.7.8 Sensiolabs Symfony 2.8.0 Sensiolabs Symfony 2.8.4 Sensiolabs Symfony 2.7.10 Sensiolabs Symfony 2.8.3 Sensiolabs Symfony 3.0.1 Sensiolabs Symfony 2.7.0 Sensiolabs Symfony 2.7.3 Sensiolabs Symfony 2.8.1 Sensiolabs Symfony 3.0.0 Sensiolabs Symfony 2.7.2 Sensiolabs Symfony 2.8.5 Sensiolabs Symfony 3.0.3 Sensiolabs Symfony 2.7.11 Sensiolabs Symfony 3.0.4 Sensiolabs Symfony 2.7.6 Sensiolabs Symfony 1.4.0 Sensiolabs Symfony 1.4.1 Sensiolabs Symfony 1.4.2 Sensiolabs Symfony 1.4.3 Sensiolabs Symfony 1.4.4 Sensiolabs Symfony 1.4.5 Sensiolabs Symfony 1.4.6 Sensiolabs Symfony 1.4.7 Sensiolabs Symfony 1.4.8 Sensiolabs Symfony 1.4.9 Sensiolabs Symfony 1.4.10 Sensiolabs Symfony 1.4.11 Sensiolabs Symfony 1.4.12 Sensiolabs Symfony 1.4.13 Sensiolabs Symfony 1.4.14 Sensiolabs Symfony 1.4.15 Sensiolabs Symfony 1.4.16 Sensiolabs Symfony 1.4.17 Sensiolabs Symfony 1.4.18 Sensiolabs Symfony 1.4.19 Sensiolabs Symfony 2.0.0 Sensiolabs Symfony 2.0.1 Sensiolabs Symfony 2.0.2 Sensiolabs Symfony 2.0.3 Sensiolabs Symfony 2.0.4 Sensiolabs Symfony 2.0.5 Sensiolabs Symfony 2.0.6 Sensiolabs Symfony 2.0.7 Sensiolabs Symfony 2.0.8 Sensiolabs Symfony 2.0.9 Sensiolabs Symfony 2.0.10 Sensiolabs Symfony 2.0.11 Sensiolabs Symfony 2.0.12 Sensiolabs Symfony 2.0.13 Sensiolabs Symfony 2.0.14 Sensiolabs Symfony 2.0.15 Sensiolabs Symfony 2.0.16 Sensiolabs Symfony 2.0.17 Sensiolabs Symfony 2.0.18 Sensiolabs Symfony 2.0.19 Sensiolabs Symfony 2.0.20 Sensiolabs Symfony 2.0.21 Sensiolabs Symfony 2.0.22 Sensiolabs Symfony 2.0.23 Sensiolabs Symfony 2.0.24 Sensiolabs Symfony 2.0.25 Sensiolabs Symfony 2.1.0 Sensiolabs Symfony 2.1.1 Sensiolabs Symfony 2.1.2 Sensiolabs Symfony 2.1.3 Sensiolabs Symfony 2.1.4 Sensiolabs Symfony 2.1.5 Sensiolabs Symfony 2.1.6 Sensiolabs Symfony 2.1.7 Sensiolabs Symfony 2.1.8 Sensiolabs Symfony 2.1.9 Sensiolabs Symfony 2.1.10 Sensiolabs Symfony 2.1.11 Sensiolabs Symfony 2.1.12 Sensiolabs Symfony 2.1.13 Sensiolabs Symfony 2.2.0 Sensiolabs Symfony 2.2.1 Sensiolabs Symfony 2.2.2 Sensiolabs Symfony 2.2.3 Sensiolabs Symfony 2.2.4 Sensiolabs Symfony 2.2.5 Sensiolabs Symfony 2.2.6 Sensiolabs Symfony 2.2.7 Sensiolabs Symfony 2.2.8 Sensiolabs Symfony 2.2.9 Sensiolabs Symfony 2.2.10 Sensiolabs Symfony 2.2.11 Sensiolabs Symfony 2.3.0 Sensiolabs Symfony 2.3.1 Sensiolabs Symfony 2.3.2 Sensiolabs Symfony 2.3.3 Sensiolabs Symfony 2.3.4 Sensiolabs Symfony 2.3.5 Sensiolabs Symfony 2.3.6 Sensiolabs Symfony 2.3.7 Sensiolabs Symfony 2.3.8 Sensiolabs Symfony 2.3.9 Sensiolabs Symfony 2.3.10 Sensiolabs Symfony 2.3.11 Sensiolabs Symfony 2.3.12 Sensiolabs Symfony 2.3.13 Sensiolabs Symfony 2.3.14 Sensiolabs Symfony 2.3.15 Sensiolabs Symfony 2.3.16 Sensiolabs Symfony 2.3.17 Sensiolabs Symfony 2.3.18 Sensiolabs Symfony 2.3.19 Sensiolabs Symfony 2.3.20 Sensiolabs Symfony 2.3.21 Sensiolabs Symfony 2.3.22 Sensiolabs Symfony 2.3.23 Sensiolabs Symfony 2.3.24 Sensiolabs Symfony 2.3.25 Sensiolabs Symfony 2.3.26 Sensiolabs Symfony 2.3.27 Sensiolabs Symfony 2.3.28 Sensiolabs Symfony 2.3.29 Sensiolabs Symfony 2.3.30 Sensiolabs Symfony 2.3.31 Sensiolabs Symfony 2.3.32 Sensiolabs Symfony 2.3.33 Sensiolabs Symfony 2.3.34 Sensiolabs Symfony 2.3.35 Sensiolabs Symfony 2.3.36 Sensiolabs Symfony 2.3.37 Sensiolabs Symfony 2.3.38 Sensiolabs Symfony 2.3.39 Sensiolabs Symfony 2.3.40 Sensiolabs Symfony 2.8.2 Sensiolabs Symfony 2.7.12 Sensiolabs Symfony 2.7.9	151
OS	Debian Debian Debian Linux 8.0	1

Common Weakness Enumeration (CWE)

CWE-399 - Resource Management Errors

Nessus

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-3588.NASL
description	Two vulnerabilities were discovered in Symfony, a PHP framework. - CVE-2016-1902 Lander Brandt discovered that the class SecureRandom might generate weak random numbers for cryptographic use under certain settings. If the functions random_bytes() or openssl_random_pseudo_bytes() are not available, the output of SecureRandom should not be consider secure. - CVE-2016-4423 Marek Alaksa from Citadelo discovered that it is possible to fill up the session storage space by submitting inexistent large usernames.
last seen	2020-06-01
modified	2020-06-02
plugin id	91365
published	2016-05-31
reporter	This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/91365
title	Debian DSA-3588-1 : symfony - security update

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Nessus

References