PT-2008-3623 · Php+1 · Php+1
Stefan Esser
·
Published
2008-05-07
·
Updated
2018-10-11
·
CVE-2008-2107
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PHP versions 4.x through 4.4.7
PHP versions 5.x through 5.2.4
Description
The issue concerns the GENERATE SEED macro, which can produce a zero seed under rare circumstances on 32-bit systems. This allows attackers to predict subsequent values of the
rand and mt rand functions, potentially bypassing protection mechanisms that rely on an unknown initial seed.Recommendations
For PHP versions 4.x through 4.4.7, update to version 4.4.8 or later.
For PHP versions 5.x through 5.2.4, update to version 5.2.5 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Php
Red Hat