The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The attemptAuthentication function in     Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41,     2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username     stored in a session, which allows remote attackers to cause a denial of service (session storage     consumption) via a series of authentication attempts with long, non-existent usernames. (CVE-2016-4423)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The attemptAuthentication function in
    Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41,
    2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username
    stored in a session, which allows remote attackers to cause a denial of service (session storage
    consumption) via a series of authentication attempts with long, non-existent usernames. (CVE-2016-4423)

Two vulnerabilities were discovered in Symfony, a PHP framework.

  - CVE-2016-1902     Lander Brandt discovered that the class SecureRandom     might generate weak random numbers for cryptographic use     under certain settings. If the functions random_bytes()     or openssl_random_pseudo_bytes() are not available, the     output of SecureRandom should not be consider secure.

  - CVE-2016-4423     Marek Alaksa from Citadelo discovered that it is     possible to fill up the session storage space by     submitting inexistent large usernames.

ID	Name	Product	Family	Type	Severity
254828	Linux Distros Unpatched Vulnerability : CVE-2016-4423	Nessus	Misc.	Local	high
434960	SCA: security update for symfony/security, symfony/security-http, symfony/symfony (GHSA-whgv-8cg3-7hcm)	Tenable Cloud Security	SCA Checks	Local	high
434960	SCA: security update for symfony/security, symfony/security-http, symfony/symfony (GHSA-whgv-8cg3-7hcm)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
91365	Debian DSA-3588-1 : symfony - security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2016-4423

high

Tenable Plugins

high

high

high

high