PT-2007-4043 · Php · Php

CVE-2007-2727 · Publicado 2007-05-16 · Atualizado 2024-08-16

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP versions prior to 4.4.7 PHP versions 5.0.x and earlier PHP versions prior to 5.2.1

Description The issue affects the encryption process, making it easier for attackers to decrypt certain data due to guessable encryption keys. This is because the mcrypt create iv function generates the same initialization vector (IV) every time, as it uses an uninitialized seed variable when calling php rand r.

Recommendations For PHP versions prior to 4.4.7, update to version 4.4.7 or later. For PHP versions 5.0.x and earlier, update to a version later than 5.0.x. For PHP versions prior to 5.2.1, update to version 5.2.1 or later.

Exploit

Correção

Identificadores relacionados

CVE-2007-2727

Produtos afetados

Php

Referências · 14

• 🔥 http://fortheloot.com/public/mcrypt.patch · Exploit
• http://mandriva.com/security/advisories?name=MDKSA-2007:187 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-2727 · Nota de Segurança
• http://secunia.com/advisories/26895 · Nota
• http://novell.com/linux/security/advisories/2007_15_sr.html · Aviso do Fabricante
• http://bugs.php.net/bug.php?id=40999 · Aviso do Fabricante
• http://blog.php-security.org/archives/80-Watching-the-PHP-CVS.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2727 · Nota
• http://osvdb.org/36087 · Nota
• http://php.net/ChangeLog-5.php · Aviso do Fabricante
• http://cvs.php.net/viewvc.cgi/php-src/ext/mcrypt/mcrypt.c?r1=1.91.2.3.2.9&r2=1.91.2.3.2.10 · Aviso do Fabricante
• http://securityfocus.com/bid/23984 · Nota
• https://t.me/cvenotify/91005 · Publicação no Telegram
• https://t.me/cvenotify/12388 · Publicação no Telegram