PT-2007-4044 · Php · Php

Stefan Esser · Published 2007-05-16 · Updated 2024-08-16 · CVE-2007-2728

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP (affected versions not specified)

Description A design error in the make http soap request() function in PHP's soap extension causes it to call php rand r() with an uninitialized variable, potentially leading to weak encryption of sensitive data. This issue could allow attackers to bypass security and gain knowledge of sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-2728

Affected Products

Php

References · 13

• http://mandriva.com/security/advisories?name=MDKSA-2007:187 · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_15_sr.html · Vendor Advisory
• http://ubuntu.com/usn/usn-485-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2728 · Security Note
• http://frsirt.com/english/advisories/2007/1839 · Note
• http://secunia.com/advisories/26895 · Note
• http://vupen.com/english/advisories/2007/1839 · Note
• http://secunia.com/advisories/25306 · Note
• http://blog.php-security.org/archives/80-Watching-the-PHP-CVS.html · Note
• https://t.me/cvenotify/91005 · Telegram Post
• https://t.me/cvenotify/12388 · Telegram Post
• http://osvdb.org/36086 · Note
• http://secunia.com/advisories/26102 · Note