PT-2010-2844 · Php+1 · Php+1

Grzegorz Stachowiak · Published 2010-03-26 · Updated 2010-12-10 · CVE-2010-1128

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.13

Description The Linear Congruential Generator (LCG) in PHP does not provide the expected entropy, making it easier for attackers to guess values that were intended to be unpredictable, such as session cookies generated by the uniqid function.

Recommendations For versions prior to 5.2.13, update to version 5.2.13 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2010-1128

DSA-2195-1

RHSA-2010:0919

RHSA-2010_0919

Affected Products

Php

Red Hat

References · 31

• 🔥 http://securityfocus.com/bid/38430 · Exploit
• 🔥 https://exploit-db.com/exploits/33677 · Exploit
• https://bdu.fstec.ru/vul/2022-02600 · Security Note
• http://php.net/releases/5_2_13.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1128 · Security Note
• http://redhat.com/support/errata/RHSA-2010-0919.html · Vendor Advisory
• http://vupen.com/english/advisories/2010/0479 · Vendor Advisory
• http://secunia.com/advisories/38708 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2010-1917 · Note
• https://access.redhat.com/security/cve/CVE-2010-0397 · Note
• http://bugs.php.net/bug.php?id=48230 · Note
• http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1128 · Note
• http://php.net/ChangeLog-5.php · Note
• https://access.redhat.com/security/cve/CVE-2010-1128 · Note