Collected research
Non-Obvious (Crypto) Bugs by Example
Two CMS bugs found by reading code. Typo3 truncated an MD5 MAC to 5 bytes and compared it with PHP's ==, so a hash of the form 0e... equals 0 and grants arbitrary file read in about 5,498 tries. Joomla seeded Mersenne Twister with CRC32 of microtime; CRC's additivity lets an attacker derive future seeds from his own reset tokens and take the admin account.
Record
- Researcher
- Gregor Kopf
- Published by
- gregorkopf.de
- Format
- Whitepaper
- Topic
- Crypto
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Gregor Kopf, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .