PT-2010-2844 · Php+1 · Php+1

Grzegorz Stachowiak · Publicado 2010-03-26 · Atualizado 2010-12-10 · CVE-2010-1128

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.13

Description The Linear Congruential Generator (LCG) in PHP does not provide the expected entropy, making it easier for attackers to guess values that were intended to be unpredictable, such as session cookies generated by the uniqid function.

Recommendations For versions prior to 5.2.13, update to version 5.2.13 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2010-1128

DSA-2195-1

RHSA-2010:0919

RHSA-2010_0919

Produtos afetados

Php

Red Hat

Referências · 31

• 🔥 http://securityfocus.com/bid/38430 · Exploit
• 🔥 https://exploit-db.com/exploits/33677 · Exploit
• https://access.redhat.com/security/cve/CVE-2010-1917 · Nota
• https://bdu.fstec.ru/vul/2022-02600 · Nota de Segurança
• http://php.net/releases/5_2_13.php · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2010-0397 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1128 · Nota de Segurança
• http://bugs.php.net/bug.php?id=48230 · Nota
• http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1128 · Nota
• http://redhat.com/support/errata/RHSA-2010-0919.html · Aviso do Fabricante
• http://php.net/ChangeLog-5.php · Nota
• https://access.redhat.com/security/cve/CVE-2010-1128 · Nota
• https://access.redhat.com/security/cve/CVE-2009-5016 · Nota
• https://access.redhat.com/security/cve/CVE-2010-3065 · Nota