Monthly Archives: May 2015

Security Affairs: PHP hash comparison flaw is a risk for million users

A recent issue has come (back) to light in the security community around how PHP compares hashes. In this post to the Security Affairs site they talk about the problem of hash comparison and how to prevent the issue in your own PHP code.

Because of a security flaw according to which PHP tackles ‘hashed’ strings in specific situation attackers are given the opportunity to try and breach passwords, authentication systems and other functions being run on PHP hash comparisons, WhiteHat security researcher says. VP of WhiteHat, Robert Hansen, declared that any website is vulnerable to the flaw – the only thing is, two specific kinds of PHP hashes the vulnerable site uses for comparing ‘hashes’ in PHP language.
The problem comes with how PHP handles its typing behind the scenes mostly. When a string starts with “0e..” PHP interprets it as scientific notation and sees it as a value equal to zero. As a result, two strings, even if they don’t match, that start with “0e…” will evaluate as equal. Fortunately, the answer is relatively simple (though could be time consuming to fix): change == (double equals) to === (triple equals). This prevents PHP from trying to do the type juggling and compare them on the types they are when presented (string to string in the case of hashes).

10 Advanced PHP Tips To Improve Your Programming

1. Use an SQL Injection Cheat Sheet

2. Know the Difference Between Comparison Operators

3. Shortcut the else

4. Drop those Brackets

5. Favour str_replace() over ereg_replace() and preg_replace()

6. Use Ternary Operators

7. Memcached

8. Use a Framework

9. Use the Suppression Operator Correctly

10. Use isset instead of strlen

click for more details

PHP 5.4.40 Released

The PHP development team announces the immediate availability of PHP 5.4.40. 14 security-related bugs were fixed in this release, including CVE-2014-9709, CVE-2015-2301, CVE-2015-2783, CVE-2015-1352. All PHP 5.4 users are encouraged to upgrade to this version.