Lucene search

MitreCVE-2007-2727

HistoryMay 16, 2007 - 10:30 p.m.

CVE-2007-2727

2007-05-1622:30:00

mitre

web.nvd.nist.gov

php

cve-2007-2727

mcrypt_create_iv

encryption

security

vulnerability

nvd

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

AI Score

7.5

Confidence

High

EPSS

0.007

Percentile

80.7%

JSON

The mcrypt_create_iv function in ext/mcrypt/mcrypt.c in PHP before 4.4.7, 5.2.1, and possibly 5.0.x and other PHP 5 versions, calls php_rand_r with an uninitialized seed variable and therefore always generates the same initialization vector (IV), which might allow context-dependent attackers to decrypt certain data more easily because of the guessable encryption keys.

Affected configurations

Nvd

Node

phpphpRange4.4.0–4.4.7

phpphpRange5.0.0–5.2.2

phpphpMatch4.0.1

phpphpMatch4.0.1patch1

phpphpMatch4.0.1patch2

phpphpMatch4.0.2

phpphpMatch4.0.3

phpphpMatch4.0.3patch1

phpphpMatch4.0.4

phpphpMatch4.0.5

phpphpMatch4.0.6

phpphpMatch4.0.7

phpphpMatch4.0.7rc1

phpphpMatch4.0.7rc2

phpphpMatch4.0.7rc3

phpphpMatch4.1.0

phpphpMatch4.1.1

phpphpMatch4.1.2

phpphpMatch4.2.0

phpphpMatch4.2.1

phpphpMatch4.2.2

phpphpMatch4.2.3

phpphpMatch4.3.0

phpphpMatch4.3.1

phpphpMatch4.3.2

phpphpMatch4.3.3

phpphpMatch4.3.4

phpphpMatch4.3.5

phpphpMatch4.3.6

phpphpMatch4.3.7

phpphpMatch4.3.8

phpphpMatch4.3.9

phpphpMatch4.3.10

phpphpMatch4.3.11

VendorProductVersionCPE
phpphp4.0.1cpe:/a:php:php:4.0.1:::
phpphp4.3.8cpe:/a:php:php:4.3.8:::
phpphp4.0.7cpe:/a:php:php:4.0.7:::
phpphp4.2.1cpe:/a:php:php:4.2.1:::
phpphp4.3.0cpe:/a:php:php:4.3.0:::
phpphp4.0.7cpe:/a:php:php:4.0.7:rc1::
phpphp4.0.7cpe:/a:php:php:4.0.7:rc2::
phpphp4.1.1cpe:/a:php:php:4.1.1:::
phpphp4.3.7cpe:/a:php:php:4.3.7:::
phpphp4.0.5cpe:/a:php:php:4.0.5:::

Vendor	Product	Version	CPE
php	php	4.0.1	cpe:/a:php:php:4.0.1:::
php	php	4.3.8	cpe:/a:php:php:4.3.8:::
php	php	4.0.7	cpe:/a:php:php:4.0.7:::
php	php	4.2.1	cpe:/a:php:php:4.2.1:::
php	php	4.3.0	cpe:/a:php:php:4.3.0:::
php	php	4.0.7	cpe:/a:php:php:4.0.7:rc1::
php	php	4.0.7	cpe:/a:php:php:4.0.7:rc2::
php	php	4.1.1	cpe:/a:php:php:4.1.1:::
php	php	4.3.7	cpe:/a:php:php:4.3.7:::
php	php	4.0.5	cpe:/a:php:php:4.0.5:::