PT-2007-4043 · Php · Php

Published 2007-05-16 · Updated 2024-08-16 · CVE-2007-2727

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP versions prior to 4.4.7 PHP versions 5.0.x and earlier PHP versions prior to 5.2.1

Description The issue affects the encryption process, making it easier for attackers to decrypt certain data due to guessable encryption keys. This is because the mcrypt create iv function generates the same initialization vector (IV) every time, as it uses an uninitialized seed variable when calling php rand r.

Recommendations For PHP versions prior to 4.4.7, update to version 4.4.7 or later. For PHP versions 5.0.x and earlier, update to a version later than 5.0.x. For PHP versions prior to 5.2.1, update to version 5.2.1 or later.

Exploit

Fix

Related Identifiers

CVE-2007-2727

Affected Products

Php

References · 14

• 🔥 http://fortheloot.com/public/mcrypt.patch · Exploit
• http://mandriva.com/security/advisories?name=MDKSA-2007:187 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2727 · Security Note
• http://novell.com/linux/security/advisories/2007_15_sr.html · Vendor Advisory
• http://bugs.php.net/bug.php?id=40999 · Vendor Advisory
• http://blog.php-security.org/archives/80-Watching-the-PHP-CVS.html · Vendor Advisory
• http://php.net/ChangeLog-5.php · Vendor Advisory
• http://cvs.php.net/viewvc.cgi/php-src/ext/mcrypt/mcrypt.c?r1=1.91.2.3.2.9&r2=1.91.2.3.2.10 · Vendor Advisory
• http://secunia.com/advisories/26895 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2727 · Note
• http://osvdb.org/36087 · Note
• http://securityfocus.com/bid/23984 · Note
• https://t.me/cvenotify/91005 · Telegram Post
• https://t.me/cvenotify/12388 · Telegram Post