PT-2008-5410 · Php · Php

Published 2008-09-18 · Updated 2018-10-30 · CVE-2008-4107

Mitre

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

The (1) rand and (2) mt rand functions in PHP 5.2.6 do not produce cryptographically strong random numbers, which allows attackers to leverage exposures in products that rely on these functions for security-relevant functionality, as demonstrated by the password-reset functionality in Joomla! 1.5.x and WordPress before 2.6.2, a different vulnerability than CVE-2008-2107, CVE-2008-2108, and CVE-2008-4102.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2008-4107

Affected Products

Php

References · 21

• http://secunia.com/advisories/31737 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4107 · Security Note
• http://secunia.com/advisories/31870 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00607.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00629.html · Vendor Advisory
• http://securityfocus.com/archive/1/496287/100/0/threaded · Note
• http://securityfocus.com/archive/1/496237/100/0/threaded · Note
• http://securityreason.com/securityalert/4271 · Note
• http://securitytracker.com/id?1020869 · Note
• http://osvdb.org/48700 · Note
• http://sektioneins.de/advisories/SE-2008-05.txt · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45956 · Note
• http://sektioneins.de/advisories/SE-2008-04.txt · Note
• http://securityfocus.com/bid/31115 · Note
• http://suspekt.org/2008/08/17/mt_srand-and-not-so-random-numbers · Note