CVE-2008-2107: High severity php vulnerability

Q: What is the severity of CVE-2008-2107?

CVE-2008-2107 is considered a moderate severity vulnerability that can potentially allow attackers to predict random values.

Q: How do I fix CVE-2008-2107?

To fix CVE-2008-2107, upgrade your PHP version to 4.4.8 or 5.2.5 or later.

Q: Which versions of PHP are affected by CVE-2008-2107?

CVE-2008-2107 affects PHP versions 4.x before 4.4.8 and 5.x before 5.2.5 on 32-bit systems.

Q: What kind of attacks can be executed using CVE-2008-2107?

Exploiting CVE-2008-2107 can allow context-dependent attackers to predict values generated by the rand and mt_rand functions.

Q: Is CVE-2008-2107 specific to any operating system?

CVE-2008-2107 specifically affects PHP running on 32-bit systems.

Published May 7, 2008

Updated

The GENERATESEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 32-bit systems, performs a multiplication using values that can produce a zero seed in rare circumstances, which allows context-dependent attackers to predict subsequent values of the rand and mtrand functions and possibly bypass protection mechanisms that rely on an unknown initial seed.

Affected Software

25 affected components

PHP PHP=5.1.5

PHP PHP=5.1.2

PHP PHP=5.1.1

PHP PHP=5.0.0-beta1

PHP PHP=5.1.6

PHP PHP=5.2.2

PHP PHP=5.0.5

PHP PHP=5.0.1

PHP PHP=5.1.4

PHP PHP=5.0.4

PHP PHP<=4.4.7

PHP PHP=5.0.0-rc2

PHP PHP=5.2.3

PHP PHP=5.0.3

PHP PHP=5.1.0

PHP PHP=5.0.0-rc3

PHP PHP=5.2.0

PHP PHP=5.2.4

PHP PHP=5.0.0-beta3

PHP PHP=5.1.3

PHP PHP=5.0.0-rc1

PHP PHP=5.0.2

PHP PHP=5.2.1

PHP PHP=5

PHP PHP=5.0.0-beta2

Event History

May 7, 2008

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-2107?

CVE-2008-2107 is considered a moderate severity vulnerability that can potentially allow attackers to predict random values.

How do I fix CVE-2008-2107?

To fix CVE-2008-2107, upgrade your PHP version to 4.4.8 or 5.2.5 or later.

Which versions of PHP are affected by CVE-2008-2107?