EllisLab/CodeIgniter — pull request #1888 by TheRook (2012-10-14 18:25:56+00:00)
Title: Develop

Improvements of Security, Efficiency, Usability, and Compatibility for CI's Session Handler.

Vulnerablities patched with this merge:
CWE - 649 : Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
- AES-CBC wiouth an message authentication code. This design allows for an attacker construction various cryptography oracle including a Decryption Oracle and a Padding Oracle
Cipher text is now protected with a SHA1 HMAC

CWE-329: Not Using a Random IV with CBC Mode
- Block Cipher implamentation used a NULL iv
ecrypt() generates a random iv for each message

CWE-327: Use of a Broken or Risky Cryptographic Algorithm
- Use of MD5 for integraty checking allowing Hash Length Extension Attacks.
Replaced with a proper sha1 hmac.

CWE-291: Trusting Self-reported IP Address
- The ip_address() method can a return user supplied value.
Only one variable can be trusted $_SERVER['REMOTE_ADDR']

List of Changes by file:
config.php - was changed for efficiency and security. Good security options are selected, and bandwidth consuption has be

AES.php - used as a backup if we cannot find an AES library.

Crypto.php - Renamed from "Encrypt.php", this now contains useful cryptographic tools such as a solid block cipher, PRNG, and HMAC.

Rijndael.php - used by AES.php

Session_cookie.php - Modified for the new crypto changes. Produces a more compact, and more random session id. Helpful er