PT-2008-3624 · Php+1 · Php+1
Stefan Esser
·
Published
2008-05-07
·
Updated
2024-02-15
·
CVE-2008-2108
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PHP versions 4.x through 4.4.7
PHP versions 5.x through 5.2.4
Description
The issue arises from the GENERATE SEED macro, which, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision. This results in producing 24 bits of entropy, simplifying brute force attacks against protection mechanisms that use the
rand and mt rand functions.Recommendations
For PHP versions 4.x through 4.4.7, update to version 4.4.8 or later.
For PHP versions 5.x through 5.2.4, update to version 5.2.5 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Php
Red Hat