CVE-2007-2727

The mcrypt_create_iv function in ext/mcrypt/mcrypt.c in PHP before 4.4.7, 5.2.1, and possibly 5.0.x and other PHP 5 versions, calls php_rand_r with an uninitialized seed variable and therefore always generates the same initialization vector (IV), which might allow context-dependent attackers to decrypt certain data more easily because of the guessable encryption keys.

Link	Resource
http://blog.php-security.org/archives/80-Watching-the-PHP-CVS.html	Vendor Advisory
http://www.fortheloot.com/public/mcrypt.patch	Exploit Patch
http://bugs.php.net/bug.php?id=40999	Vendor Advisory
http://cvs.php.net/viewvc.cgi/php-src/ext/mcrypt/mcrypt.c?r1=1.91.2.3.2.9&r2=1.91.2.3.2.10	Vendor Advisory
http://www.php.net/ChangeLog-5.php	Vendor Advisory
http://www.securityfocus.com/bid/23984	Third Party Advisory VDB Entry
http://www.mandriva.com/security/advisories?name=MDKSA-2007:187	Broken Link
http://www.novell.com/linux/security/advisories/2007_15_sr.html	Third Party Advisory
http://secunia.com/advisories/26895	Broken Link
http://osvdb.org/36087	Broken Link

Configuration 1

cpe:2.3:a:php:php:4.3.9:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.2.0:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.1.0:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.4:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.4:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.0:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.5:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.6:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.7:rc2:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.7:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.7:rc1:*:*:*:*:*:* cpe:2.3:a:php:php:4.2.2:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.2:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.11:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.3:patch1:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.7:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.2:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.3:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.1.1:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.2.3:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.1:patch1:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.1:patch2:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.6:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.1.2:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.7:rc3:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.1:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.10:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.2.1:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.1:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.3:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.8:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.5:*:*:*:*:*:*:* cpe:2.3:a:php:php:*:*:*:*:*:*:*:* cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

---

Published : 2007-05-16 10:30

Updated : 2022-11-07 03:05

---

NVD link : CVE-2007-2727

Mitre link : CVE-2007-2727

No products.

NVD-CWE-Other