CVE-2010-1128: Medium severity PHP PHP vulnerability

Q: What is the severity of CVE-2010-1128?

CVE-2010-1128 has a low severity, but it can lead to potential information disclosure by allowing attackers to predict session identifiers.

Q: How do I fix CVE-2010-1128?

To fix CVE-2010-1128, upgrade PHP to version 5.2.13 or later where the vulnerability is patched.

Q: What versions of PHP are affected by CVE-2010-1128?

CVE-2010-1128 affects PHP versions 5.2.0 through 5.2.12.

Q: What type of attack does CVE-2010-1128 facilitate?

CVE-2010-1128 facilitates context-dependent attacks that allow attackers to guess unpredictable values such as session cookies.

Q: Is the vulnerability CVE-2010-1128 present in PHP 5.2.13?

No, CVE-2010-1128 is not present in PHP version 5.2.13 and later, as this version addresses the issue.

Published Mar 26, 2010

Updated

The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function.

Affected Software

13 affected components

PHP PHP=5.2.9

PHP PHP=5.2.7

PHP PHP=5.2.2

PHP PHP=5.2.5

PHP PHP<=5.2.12

PHP PHP=5.2.11

PHP PHP=5.2.6

PHP PHP=5.2.3

PHP PHP=5.2.0

PHP PHP=5.2.4

PHP PHP=5.2.10

PHP PHP=5.2.1

PHP PHP=5.2.8

Remediation

Patch Available

http://www.vupen.com/english/advisories/2010/0479

Event History

Mar 26, 2010

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Data Sourced

via NVD·08:30 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-1128?

CVE-2010-1128 has a low severity, but it can lead to potential information disclosure by allowing attackers to predict session identifiers.

How do I fix CVE-2010-1128?