NVD

Id
2042  
Name
CVE-2008-2108  
Description
The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against protection mechanisms that use the rand and mt_rand functions.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-03  
Published
2008-05-07  
Modified Date
2012-10-30  
Seq
2008-2108  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
13133 2042 CVE-2008-2108 20080506 Advisory SE-2008-02: PHP GENERATE_SEED() Weak Random Number Seed Vulnerability  View
13134 2042 CVE-2008-2108 oval:org.mitre.oval:def:10844  View
13135 2042 CVE-2008-2108 GLSA-200811-05  View
13136 2042 CVE-2008-2108 3859  View
13137 2042 CVE-2008-2108 DSA-1789  View
13138 2042 CVE-2008-2108 MDVSA-2008:125  View
13139 2042 CVE-2008-2108 MDVSA-2008:126  View
13140 2042 CVE-2008-2108 MDVSA-2008:127  View
13141 2042 CVE-2008-2108 MDVSA-2008:128  View
13142 2042 CVE-2008-2108 MDVSA-2008:129  View
13143 2042 CVE-2008-2108 MDVSA-2008:130  View
13144 2042 CVE-2008-2108 RHSA-2008:0505  View
13145 2042 CVE-2008-2108 RHSA-2008:0544  View
13146 2042 CVE-2008-2108 RHSA-2008:0545  View
13147 2042 CVE-2008-2108 RHSA-2008:0546  View
13148 2042 CVE-2008-2108 RHSA-2008:0582  View
13149 2042 CVE-2008-2108 20080506 Advisory SE-2008-02: PHP GENERATE_SEED() Weak Random Number Seed Vulnerability  View
13150 2042 CVE-2008-2108 http://www.sektioneins.de/advisories/SE-2008-02.txt  View
13151 2042 CVE-2008-2108 USN-628-1  View
13152 2042 CVE-2008-2108 php-generateseed-weak-security(42226)  View
13153 2042 CVE-2008-2108 FEDORA-2008-3864  View
13154 2042 CVE-2008-2108 FEDORA-2008-3606  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
46021 JVNDB-2008-001331 PHP の rand() 関数および mt_rand() 関数におけるブルートフォース攻撃される脆弱性 64 ビットシステムで動作する PHP の GENERATE_SEED マクロには、エントロピーの 24 ビットを生成する際の不正確さにより、ゼロビットの部分を生成する乗算を行うため、ブルートフォース攻撃を容易にする脆弱性が存在します。 CVE-2008-2108 32221 CVE-2008-2108 2042 7.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001331.html 2008-05-07 2008-11-26 View