Looking for more information on how to do PHP the right way? Check out PHP: The Right Way

PHP SOAP Extension HTTP Authentication Weak Nonce
May 16, 2007 @ 09:31:00

Secunia has a new advisory posted concerning an issue discovered with PHP's SOAP extension's HTTP authentication mechanism:

The weakness is caused due to the use of an uninitialized variable within the function "make_http_soap_request()" of the SOAP extension when calling "php_rand_r()" to generate the nonce for the digest authentication, which may result in a weak and predictable nonce.

The issue is marked as "less critical" but should still be taken into consideration. The issue has been corrected in the latest CVS commit.

tagged: soap extension weak nonce phprandr cvs commit soap extension weak nonce phprandr cvs commit