CVE-2008-1484

The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the targeted account. NOTE: this issue might be related to CVE-2006-5737.

Link	Resource
http://sektioneins.de/advisories/SE-2008-01.txt
http://punbb.org/download/changelogs/1.2.16_to_1.2.17.txt
http://punbb.org/forums/viewtopic.php?id=18460
http://www.securityfocus.com/bid/27908	Patch
http://secunia.com/advisories/29043	Vendor Advisory
http://osvdb.org/45561
https://www.exploit-db.com/exploits/5165
http://www.securityfocus.com/archive/1/488408/100/200/threaded

Configuration 1

cpe:2.3:a:punbb:punbb:1.2.3:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.2.7:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.0_beta2:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.2.5:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.2.10:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.0:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.2.1:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.1.5:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.1:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.2.14:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.2.13:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.0.1:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.1.1:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.2.15:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.0_beta3:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.2.12:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.0_rc1:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.1.3:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.0_rc2:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.0_beta1:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.2.4:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.2.11:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.2.8:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.2.2:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.2:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.2.16:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.1.4:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.0_alpha:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.2.6:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.1.2:*:*:*:*:*:*:* cpe:2.3:a:punbb:punbb:1.2.9:*:*:*:*:*:*:*

---

Published : 2008-03-24 11:44

Updated : 2018-10-11 08:35

---

NVD link : CVE-2008-1484

Mitre link : CVE-2008-1484

No products.

CWE-264