CVE-2008-2108

The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against protection mechanisms that use the rand and mt_rand functions.

Link	Resource
http://archives.neohapsis.com/archives/fulldisclosure/2008-05/0103.html	Exploit
http://www.sektioneins.de/advisories/SE-2008-02.txt	Exploit
http://www.mandriva.com/security/advisories?name=MDVSA-2008:130
http://www.redhat.com/support/errata/RHSA-2008-0582.html
http://www.mandriva.com/security/advisories?name=MDVSA-2008:128
http://www.mandriva.com/security/advisories?name=MDVSA-2008:125
http://secunia.com/advisories/31119
http://www.redhat.com/support/errata/RHSA-2008-0505.html
http://secunia.com/advisories/31200
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00773.html
http://secunia.com/advisories/30757
http://www.mandriva.com/security/advisories?name=MDVSA-2008:126
http://www.redhat.com/support/errata/RHSA-2008-0546.html
http://www.redhat.com/support/errata/RHSA-2008-0545.html
http://secunia.com/advisories/31124
http://www.mandriva.com/security/advisories?name=MDVSA-2008:127
http://www.redhat.com/support/errata/RHSA-2008-0544.html
http://www.mandriva.com/security/advisories?name=MDVSA-2008:129
http://www.ubuntu.com/usn/usn-628-1
http://secunia.com/advisories/30828
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00779.html
http://securityreason.com/securityalert/3859
http://secunia.com/advisories/35003
http://www.debian.org/security/2009/dsa-1789
http://secunia.com/advisories/32746
http://security.gentoo.org/glsa/glsa-200811-05.xml
https://exchange.xforce.ibmcloud.com/vulnerabilities/42226
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10844
http://www.securityfocus.com/archive/1/491683/100/0/threaded

Configuration 1

cpe:2.3:a:php:php:5.1.5:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.1.2:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.1.1:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.0.0:beta1:*:*:*:*:*:* cpe:2.3:a:php:php:5.1.6:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.2.2:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.0.5:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.0.1:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.1.4:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.0.4:*:*:*:*:*:*:* cpe:2.3:a:php:php:*:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.0.0:rc2:*:*:*:*:*:* cpe:2.3:a:php:php:5.2.3:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.0.3:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.1.0:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.0.0:rc3:*:*:*:*:*:* cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.2.4:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.0.0:beta3:*:*:*:*:*:* cpe:2.3:a:php:php:5.1.3:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.0.0:rc1:*:*:*:*:*:* cpe:2.3:a:php:php:5.0.2:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:* cpe:2.3:a:php:php:5:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.0.0:beta2:*:*:*:*:*:*

---

Published : 2008-05-07 09:20

Updated : 2018-10-11 08:39

---

NVD link : CVE-2008-2108

Mitre link : CVE-2008-2108

No products.

CWE-331

Insufficient Entropy