CVE-2010-1128

Published Mar 26, 2010

Last updated 14 years ago

Overview

Description: The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function.
Source: cve@mitre.org
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 6.4
Impact score: 4.9
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:P/A:N

Weaknesses

nvd@nist.gov: CWE-310

Vendor comments

Red HatRed Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=577582 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "438EC66E-3D70-4780-AC53-22F850818612",
            "versionEndIncluding": "5.2.12"
          },
          {
            "criteria": "cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CD02D837-FD28-4E0F-93F8-25E8D1C84A99"
          },
          {
            "criteria": "cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "88358D1E-BE6F-4CE3-A522-83D1FA4739E3"
          },
          {
            "criteria": "cpe:2.3:a:php:php:5.2.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D8B97B03-7DA7-4A5F-89B4-E78CAB20DE17"
          },
          {
            "criteria": "cpe:2.3:a:php:php:5.2.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "86767200-6C9C-4C3E-B111-0E5BE61E197B"
          },
          {
            "criteria": "cpe:2.3:a:php:php:5.2.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B00B416D-FF23-4C76-8751-26D305F0FA0F"
          },
          {
            "criteria": "cpe:2.3:a:php:php:5.2.5:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CCB6CDDD-70D3-4004-BCE0-8C4723076103"
          },
          {
            "criteria": "cpe:2.3:a:php:php:5.2.6:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A782CA26-9C38-40A8-92AE-D47B14D2FCE3"
          },
          {
            "criteria": "cpe:2.3:a:php:php:5.2.7:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1C0E7E2A-4770-4B68-B74C-5F5A6E1876DC"
          },
          {
            "criteria": "cpe:2.3:a:php:php:5.2.8:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0892C89E-9389-4452-B7E0-981A763CD426"
          },
          {
            "criteria": "cpe:2.3:a:php:php:5.2.9:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "635F3CB1-B042-43CC-91AB-746098018D8C"
          },
          {
            "criteria": "cpe:2.3:a:php:php:5.2.10:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E1F32DDF-17A3-45B5-9227-833EBEBD3923"
          },
          {
            "criteria": "cpe:2.3:a:php:php:5.2.11:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2CDFB7E9-8510-430F-BFBC-FD811D60DC78"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Vendor comments

Configurations

References