PHP CVEs

Description

The mcrypt_create_iv function in ext/mcrypt/mcrypt.c in PHP before 4.4.7, 5.2.1, and possibly 5.0.x and other PHP 5 versions, calls php_rand_r with an uninitialized seed variable and therefore always generates the same initialization vector (IV), which might allow context-dependent attackers to decrypt certain data more easily because of the guessable encryption keys.

Affected products and versions

• PHP — From 4.4.0 (including) to 4.4.7 (excluding)
• PHP — From 5.0.0 (including) to 5.2.2 (excluding)
• PHP versions 4.0.1, 4.0.1patch1, 4.0.1patch2, 4.0.2, 4.0.3, 4.0.3patch1, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.7rc1, 4.0.7rc2, 4.0.7rc3, 4.1.0, 4.1.1, 4.1.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11

References

• blog.php-security.org http://blog.php-security.org/archives/80-Watching-the-PHP-CVS.html Vendor Advisory
• bugs.php.net http://bugs.php.net/bug.php?id=40999 Vendor Advisory
• cvs.php.net http://cvs.php.net/viewvc.cgi/php-src/ext/mcrypt/mcrypt.c?r1=1.91.2.3.2.9&r2=1.91.2.3.2.10 Vendor Advisory
• osvdb.org http://osvdb.org/36087 Broken Link
• secunia.com http://secunia.com/advisories/26895 Broken Link
• www.fortheloot.com http://www.fortheloot.com/public/mcrypt.patch Exploit, Patch, Third Party Advisory
• www.mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2007:187 Broken Link
• www.novell.com http://www.novell.com/linux/security/advisories/2007_15_sr.html Third Party Advisory
• www.php.net http://www.php.net/ChangeLog-5.php Vendor Advisory
• www.securityfocus.com http://www.securityfocus.com/bid/23984 Third Party Advisory, VDB Entry
• nvd.nist.gov Official NVD record