CVE-2008-2108

Published: May 7, 2008Modified: Apr 23, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against protection mechanisms that use the rand and mt_rand functions.

Affected (9)

Products: Php: Php · Fedoraproject: Fedora · Canonical: Ubuntu Linux · +1 more

Show all products

Php: Php · Fedoraproject: Fedora · Canonical: Ubuntu Linux · Debian: Debian Linux

1 product

1 product

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Php Php	From 4.0.0 to 4.4.8
Php Php	From 5.0.0 to 5.2.5

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 8
Fedoraproject Fedora	Version 9

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 7.04
Canonical Ubuntu Linux	Version 7.10
Canonical Ubuntu Linux	Version 8.04

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 4.0

Related CWEs

CWE-331

Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

References (58)

http://archives.neohapsis.com/archives/fulldisclosure/2008-05/0103.html

Source: cve@mitre.org

Broken LinkExploit

http://secunia.com/advisories/30757

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/30828

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/31119

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/31124

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/31200

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/32746

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/35003

Source: cve@mitre.org

Broken Link

http://security.gentoo.org/glsa/glsa-200811-05.xml

Source: cve@mitre.org

Third Party Advisory

http://securityreason.com/securityalert/3859

Source: cve@mitre.org

Mailing List

http://www.debian.org/security/2009/dsa-1789

Source: cve@mitre.org

Mailing List

http://www.mandriva.com/security/advisories?name=MDVSA-2008:125

Source: cve@mitre.org

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2008:126

Source: cve@mitre.org

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2008:127

Source: cve@mitre.org

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2008:128

Source: cve@mitre.org

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2008:129

Source: cve@mitre.org

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2008:130

Source: cve@mitre.org

Broken Link

http://www.redhat.com/support/errata/RHSA-2008-0505.html

Source: cve@mitre.org

Broken Link

http://www.redhat.com/support/errata/RHSA-2008-0544.html

Source: cve@mitre.org

Broken Link

http://www.redhat.com/support/errata/RHSA-2008-0545.html

Source: cve@mitre.org

Broken Link

http://www.redhat.com/support/errata/RHSA-2008-0546.html

Source: cve@mitre.org

Broken Link

http://www.redhat.com/support/errata/RHSA-2008-0582.html

Source: cve@mitre.org

Broken Link

http://www.securityfocus.com/archive/1/491683/100/0/threaded

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.sektioneins.de/advisories/SE-2008-02.txt

Source: cve@mitre.org

Broken LinkExploit

http://www.ubuntu.com/usn/usn-628-1

Source: cve@mitre.org

Third Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/42226

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10844

Source: cve@mitre.org

Broken Link

https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00773.html

Source: cve@mitre.org

Mailing List

https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00779.html

Source: cve@mitre.org

Mailing List

http://archives.neohapsis.com/archives/fulldisclosure/2008-05/0103.html