First published: Wed May 07 2008(Updated: )
The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against protection mechanisms that use the rand and mt_rand functions.
Credit: cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
PHP PHP | =5.1.5 | |
PHP PHP | =5.1.2 | |
PHP PHP | =5.1.1 | |
PHP PHP | =5.0.0-beta1 | |
PHP PHP | =5.1.6 | |
PHP PHP | =5.2.2 | |
PHP PHP | =5.0.5 | |
PHP PHP | =5.0.1 | |
PHP PHP | =5.1.4 | |
PHP PHP | =5.0.4 | |
PHP PHP | <=4.4.7 | |
PHP PHP | =5.0.0-rc2 | |
PHP PHP | =5.2.3 | |
PHP PHP | =5.0.3 | |
PHP PHP | =5.1.0 | |
PHP PHP | =5.0.0-rc3 | |
PHP PHP | =5.2.0 | |
PHP PHP | =5.2.4 | |
PHP PHP | =5.0.0-beta3 | |
PHP PHP | =5.1.3 | |
PHP PHP | =5.0.0-rc1 | |
PHP PHP | =5.0.2 | |
PHP PHP | =5.2.1 | |
PHP PHP | =5 | |
PHP PHP | =5.0.0-beta2 | |
PHP PHP | >=4.0.0<4.4.8 | |
PHP PHP | >=5.0.0<5.2.5 | |
Fedoraproject Fedora | =8 | |
Fedoraproject Fedora | =9 | |
Canonical Ubuntu Linux | =6.06 | |
Canonical Ubuntu Linux | =7.04 | |
Canonical Ubuntu Linux | =7.10 | |
Canonical Ubuntu Linux | =8.04 | |
Debian Debian Linux | =4.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.