ZF2016-01: Potential Insufficient Entropy Vulnerability in Zend Framework 1
ZF2016-01: Potential Insufficient Entropy Vulnerability in ZF1
We discovered several methods used to generate random numbers in ZF1 that
potentially used insufficient entropy. These random number generators are used
in the following method calls:
In each case, the methods were using
mt_rand(), neither of which
can generate cryptographically secure values. This could potentially lead to
information disclosure should an attacker be able to brute force the random
Moreover, we discovered a potential security issue in the usage of the
Zend_Crypt_Math::randBytes, reported in PHP BUG
#70014, and the security implications
reported in a discussion on the random_compat library.
We replaced the usage of
mt_rand() with the random generators of
ZF1 implemented in Zend_Crypt_Math().
Moreover, we removed the usage of
openssl_random_pseudo_bytes() functions in
Zend_Crypt_Math::randBytes(). This removal is not a BC break for Linux users
thanks to the usage of
/dev/urandom as an entropy source. For Windows users,
this can be a BC break if the Mcrypt extension is not enabled.
The following releases contain the fixes:
- Zend Framework 1.12.18
If you are using an affected version of PHP, we highly recommend upgrading
immediately to Zend Framework 1.12.18.
The Zend Framework team thanks the following for identifying the issues and
working with us to help protect its users:
- Brian Engert of Soliant Consulting, who
discovered, reported, and proposed a patch for the issue;
Enrico Zimuel, who tested the patch and added the patch
for the OpenSSL usage removal.
Source: Zend security feed