CVE-2008-2108

The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against protection mechanisms that use the rand and mt_rand functions.

Weakness

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Affected Software

Name	Vendor	Start Version	End Version
Php	Php	4.0.0 (including)	4.4.8 (excluding)
Php	Php	5.0.0 (including)	5.2.5 (excluding)
Red Hat Enterprise Linux 2.1	RedHat	php-0:4.1.2-2.20	*
Red Hat Enterprise Linux 3	RedHat	php-0:4.3.2-48.ent	*
Red Hat Enterprise Linux 4	RedHat	php-0:4.3.9-3.22.12	*
Red Hat Enterprise Linux 5	RedHat	php-0:5.1.6-20.el5_2.1	*
Red Hat Web Application Stack for RHEL 4	RedHat	php-0:5.1.6-3.el4s1.10	*
Php5	Ubuntu	dapper	*
Php5	Ubuntu	feisty	*
Php5	Ubuntu	gutsy	*
Php5	Ubuntu	hardy	*
Php5	Ubuntu	upstream	*

Potential Mitigations

https://cwe.mitre.org/data/definitions/59.html

NVD	https://nvd.nist.gov/vuln/detail/CVE-2008-2108
CWE	https://cwe.mitre.org/data/definitions/331.html

Insufficient Entropy

Weakness

Affected Software

Potential Mitigations

References

CVE-2008-2108

Insufficient Entropy

Weakness

Affected Software

Potential Mitigations

Related Attack Patterns

References