CVE-2008-2108

Name of the Vulnerable Software and Affected Versions PHP versions 4.x through 4.4.7 PHP versions 5.x through 5.2.4

Description The issue arises from the GENERATE SEED macro, which, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision. This results in producing 24 bits of entropy, simplifying brute force attacks against protection mechanisms that use the rand and mt rand functions.

Recommendations For PHP versions 4.x through 4.4.7, update to version 4.4.8 or later. For PHP versions 5.x through 5.2.4, update to version 5.2.5 or later.