CRITICAL
PHP weak 64 bit random seed
Published May 7, 2008
9.8
CRITICALCVSS 3.1
EPSS 4.29%
Description
The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against protection mechanisms that use the rand and mt_rand functions.
Affected products
No data.
Configuration 2
OR
- 8
- 9
Configuration 3
OR
- 6.06
- 7.04
- 7.10
- 8.04
Configuration 4
- 4.0
No data.
Red Hat Enterprise Linux 2.1
php-0:4.1.2-2.20
Fixed · RHSA-2008:0546
Red Hat Enterprise Linux 3
php-0:4.3.2-48.ent
Fixed · RHSA-2008:0544
Red Hat Enterprise Linux 4
php-0:4.3.9-3.22.12
Fixed · RHSA-2008:0545
Red Hat Enterprise Linux 5
php-0:5.1.6-20.el5_2.1
Fixed · RHSA-2008:0544
Red Hat Web Application Stack for RHEL 4
php-0:5.1.6-3.el4s1.10
Fixed · RHSA-2008:0582
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 2.1 | php-0:4.1.2-2.20 | Fixed | RHSA-2008:0546 |
| Red Hat Enterprise Linux 3 | php-0:4.3.2-48.ent | Fixed | RHSA-2008:0544 |
| Red Hat Enterprise Linux 4 | php-0:4.3.9-3.22.12 | Fixed | RHSA-2008:0545 |
| Red Hat Enterprise Linux 5 | php-0:5.1.6-20.el5_2.1 | Fixed | RHSA-2008:0544 |
| Red Hat Web Application Stack for RHEL 4 | php-0:5.1.6-3.el4s1.10 | Fixed | RHSA-2008:0582 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
9.8 CRITICAL NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
No CVSS v3.0 score for this CVE.
7.5 HIGH NVD
AV:N/AC:L/Au:N/C:P/I:P/A:P
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
4.29% 0.04289
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.04289
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (14 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 4.29% (0.04289) | 90.81th | v5 (v2026.06.15) |
| Jun 15, 2026 | 4.29% (0.04289) | 89.81th | v5 (v2026.06.15) |
| Dec 27, 2025 | 5.92% (0.05915) | 90.35th | v4 (v2025.03.14) |
| Oct 29, 2025 | 4.74% (0.04738) | 88.90th | v4 (v2025.03.14) |
| Oct 27, 2025 | 5.92% (0.05915) | 90.22th | v4 (v2025.03.14) |
| Oct 1, 2025 | 4.74% (0.04738) | 89.00th | v4 (v2025.03.14) |
| Jul 30, 2025 | 5.92% (0.05915) | 90.25th | v4 (v2025.03.14) |
| Mar 17, 2025 | 4.74% (0.04738) | 88.68th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.36% (0.00358) | 73.01th | v3 (v2023.03.01) |
| Feb 15, 2024 | 0.36% (0.00358) | 71.39th | v3 (v2023.03.01) |
| Mar 7, 2023 | 1.90% (0.01897) | 86.63th | v3 (v2023.03.01) |
| Mar 6, 2023 | 2.69% (0.02686) | 82.85th | v2 (v2022.01.01) |
| Apr 1, 2022 | 2.69% (0.02686) | 81.17th | v2 (v2022.01.01) |
| Feb 4, 2022 | 2.69% (0.02686) | 62.66th | v2 (v2022.01.01) |
Weaknesses (1)
References (33)
- http://archives.neohapsis.com/archives/fulldisclosure/2008-05/0103.html mailing-listx_refsource_FULLDISCBroken LinkExploit
- http://secunia.com/advisories/30757 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/30828 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/31119 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/31124 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/31200 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/32746 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/35003 third-party-advisoryx_refsource_SECUNIABroken Link
- http://security.gentoo.org/glsa/glsa-200811-05.xml vendor-advisoryx_refsource_GENTOOThird Party Advisory
- http://securityreason.com/securityalert/3859 third-party-advisoryx_refsource_SREASONMailing List
- http://www.debian.org/security/2009/dsa-1789 vendor-advisoryx_refsource_DEBIANMailing List
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:125 vendor-advisoryx_refsource_MANDRIVABroken Link
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:126 vendor-advisoryx_refsource_MANDRIVABroken Link
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:127 vendor-advisoryx_refsource_MANDRIVABroken Link
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:128 vendor-advisoryx_refsource_MANDRIVABroken Link
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:129 vendor-advisoryx_refsource_MANDRIVABroken Link
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:130 vendor-advisoryx_refsource_MANDRIVABroken Link
- http://www.redhat.com/support/errata/RHSA-2008-0505.html vendor-advisoryx_refsource_REDHATBroken Link
- http://www.redhat.com/support/errata/RHSA-2008-0544.html vendor-advisoryx_refsource_REDHATBroken Link
- http://www.redhat.com/support/errata/RHSA-2008-0545.html vendor-advisoryx_refsource_REDHATBroken Link
- http://www.redhat.com/support/errata/RHSA-2008-0546.html vendor-advisoryx_refsource_REDHATBroken Link
- http://www.redhat.com/support/errata/RHSA-2008-0582.html vendor-advisoryx_refsource_REDHATBroken Link
- http://www.securityfocus.com/archive/1/491683/100/0/threaded mailing-listx_refsource_BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
- http://www.sektioneins.de/advisories/SE-2008-02.txt x_refsource_MISCBroken LinkExploit
- http://www.ubuntu.com/usn/usn-628-1 vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2008-2108 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=445685 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42226 vdb-entryx_refsource_XFThird Party AdvisoryVDB Entry
- https://nvd.nist.gov/vuln/detail/CVE-2008-2108
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10844 vdb-entrysignaturex_refsource_OVALBroken Link
- https://www.cve.org/CVERecord?id=CVE-2008-2108
- https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00773.html vendor-advisoryx_refsource_FEDORAMailing List
- https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00779.html vendor-advisoryx_refsource_FEDORAMailing List
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published May 7, 2008
Updated Aug 7, 2024
Reserved May 7, 2008
Link CVE-2008-2108
CISA Vulnrichment
Updated n/a