CVE-2008-2108
Critical
Description
The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against protection mechanisms that use the rand and mt_rand functions.
SeverityCritical
CVSS9.8
Exploit probability91. percentile4.3%
Product
Php
PublishedMay 7, 2008
First seenMay 7, 2008
Weakness typeCWE-331CWE-331
How to fix
Update
- php php4.4.8, 5.2.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| php php | 4.0.0 ≤ v < 4.4.8, 5.0.0 ≤ v < 5.2.5 | 4.4.8, 5.2.5 |
| fedoraproject fedora | 8, 9 | — |
| canonical ubuntu_linux | 6.06, 7.04, 7.10, 8.04 | — |
| debian debian_linux | 4.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.