Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I wish NCC Group had been given more time, since phpMyAdmin is nigh-ubiquitous in legacy PHP apps.

For example:

https://github.com/phpmyadmin/phpmyadmin/blob/4cd8ab8a957a23...

Despite setting several security-related session configuration values, they don't touch the cookie entropy fields, which means a potential session fixation vulnerability.

This might not be a concern for most users: typically your distro ships a php.ini configured to read at least 16 bytes from /dev/urandom. But not always! Many projects set cookie.entropy_length and cookie.entropy_source just to be sure.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: