CVE

Id
26084  
CVE No.
CVE-2007-2727  
Status
Candidate  
Description
The mcrypt_create_iv function in ext/mcrypt/mcrypt.c in PHP before 4.4.7, 5.2.1, and possibly 5.0.x and other PHP 5 versions, calls php_rand_r with an uninitialized seed variable and therefore always generates the same initialization vector (IV), which might allow context-dependent attackers to decrypt certain data more easily because of the guessable encryption keys.  
Phase
Assigned (20070516)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
262392 26084 CVE-2007-2727 MISC:http://blog.php-security.org/archives/80-Watching-the-PHP-CVS.html  View
262393 26084 CVE-2007-2727 MISC:http://www.fortheloot.com/public/mcrypt.patch  View
262394 26084 CVE-2007-2727 CONFIRM:http://bugs.php.net/bug.php?id=40999  View
262395 26084 CVE-2007-2727 CONFIRM:http://cvs.php.net/viewvc.cgi/php-src/ext/mcrypt/mcrypt.c?r1=1.91.2.3.2.9&r2=1.91.2.3.2.10  View
262396 26084 CVE-2007-2727 CONFIRM:http://www.php.net/ChangeLog-5.php  View
262397 26084 CVE-2007-2727 MANDRIVA:MDKSA-2007:187  View
262398 26084 CVE-2007-2727 URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:187  View
262399 26084 CVE-2007-2727 SUSE:SUSE-SR:2007:015  View
262400 26084 CVE-2007-2727 URL:http://www.novell.com/linux/security/advisories/2007_15_sr.html  View
262401 26084 CVE-2007-2727 BID:23984  View
262402 26084 CVE-2007-2727 URL:http://www.securityfocus.com/bid/23984  View
262403 26084 CVE-2007-2727 OSVDB:36087  View
262404 26084 CVE-2007-2727 URL:http://osvdb.org/36087  View
262405 26084 CVE-2007-2727 SECUNIA:26895  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
53343 JVNDB-2007-002035 Comodo Firewall Pro における Microsoft Windows API 機能が呼び出される脆弱性 Comodo Firewall Pro および Comodo Personal Firewall は、NT カーネルの特定の Microsoft Windows API 機能に対してプロセス識別子が同一か適切にテストしないため、Microsoft Windows API 機能が呼び出される、ファイアーウォールルールを回避される、または権限を取得される脆弱性が存在します。 CVE-2007-2729 26084 7.2 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-002035.html  View