CVE-2008-2108

high-risk
Published 2008-05-07

The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against protection mechanisms that use the rand and mt_rand functions.

Do I need to act?

~
5.6% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (8)

Php

Affected Vendors

Fedoraproject Php Debian Canonical

References (58)

Broken Link http://archives.neohapsis.com/archives/fulldisclosure/2008-05/0103.html
Broken Link http://secunia.com/advisories/30757
Broken Link http://secunia.com/advisories/30828
Broken Link http://secunia.com/advisories/31119
Broken Link http://secunia.com/advisories/31124
Broken Link http://secunia.com/advisories/31200
Broken Link http://secunia.com/advisories/32746
Broken Link http://secunia.com/advisories/35003
Third Party Advisory http://security.gentoo.org/glsa/glsa-200811-05.xml
Mailing List http://securityreason.com/securityalert/3859
Mailing List http://www.debian.org/security/2009/dsa-1789
Broken Link http://www.mandriva.com/security/advisories?name=MDVSA-2008:125
Broken Link http://www.mandriva.com/security/advisories?name=MDVSA-2008:126
Broken Link http://www.mandriva.com/security/advisories?name=MDVSA-2008:127
Broken Link http://www.mandriva.com/security/advisories?name=MDVSA-2008:128
Broken Link http://www.mandriva.com/security/advisories?name=MDVSA-2008:129
Broken Link http://www.mandriva.com/security/advisories?name=MDVSA-2008:130
Broken Link http://www.redhat.com/support/errata/RHSA-2008-0505.html
Broken Link http://www.redhat.com/support/errata/RHSA-2008-0544.html
Broken Link http://www.redhat.com/support/errata/RHSA-2008-0545.html
and 38 more references
54
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 8/34 · Low
Exposure 14/34 · Moderate