CVE-2008-2108: Critical severity php vulnerability
The GENERATESEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against protection mechanisms that use the rand and mtrand functions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2108?
CVE-2008-2108 has a high severity level due to its potential to allow brute force attacks that compromise security.
How do I fix CVE-2008-2108?
To fix CVE-2008-2108, upgrade PHP to version 4.4.8 or later for PHP 4.x, or to 5.2.5 or later for PHP 5.x.
Which versions of PHP are affected by CVE-2008-2108?
CVE-2008-2108 affects PHP versions prior to 4.4.8 and 5.2.5, specifically versions 4.x and 5.x running on 64-bit systems.
What does CVE-2008-2108 exploit in PHP?
CVE-2008-2108 exploits a flaw in the GENERATE_SEED macro that results in insufficient entropy generation.
Is there a workaround for CVE-2008-2108?
There are no known effective workarounds for CVE-2008-2108, and upgrading to a patched version is the recommended solution.