Tuesday, August 28, 2012

CVE-2012-2760 Session Stealing in mod_auth_openid

As advisory describing, mod_auth_openid is vulnerable to session stealing. Because "Session ids are stored insecurely in /tmp/mod_auth_openid.db (default filename). The db is world readable and the session ids are stored unencrypted." [1]

Yes, this is important issue and file is accessible by local attackers. But more important issue is database file also accessible by remote attackers in some cases (For example, if application have some kind of arbitrary file download/access vulnerability like LFI) because file is located in tmp folder (apache can access tmp directory) and sqlite db is not encrypted.


SQLite is not supporting database file encryption but there are some external libraries that "provides transparent 256-bit AES encryption of database files". [2]

Dear mod_auth_openid developers, you should use database file encryption. :(

[1] http://seclists.org/fulldisclosure/2012/May/238
[2] http://sqlcipher.net/

Wednesday, August 15, 2012

Uniform Binary Search Implementation in JavaScript

Uniform binary search is an optimization of the classic binary search algorithm invented by Donald Knuth and given in Knuth's The Art of Computer Programming. It uses a lookup table to update a single array index, rather than taking the midpoint of an upper and a lower bound on each iteration; therefore, it is optimized for architectures (such as Knuth's MIX) on which
  • a table lookup is generally faster than an addition and a shift, and 
  • many searches will be performed on the same array, or on several arrays of the same length

Just simply implemented in JS from original C source of Knuth's algorithm.


// target = [91, 97, 99, 101, 127, 129, 145]
// will found index of 127 via optimized bin search algo.

thinking...
-----------------
middle of target: 3
127 is bigger than 101
127 is less than 129
127 at index: 4

Source: http://jsfiddle.net/VCtqD/1/