Bug 674709 (CVE-2011-0755) - CVE-2011-0755 php: mt_rand() does not check that max is greater than min
Summary: CVE-2011-0755 php: mt_rand() does not check that max is greater than min
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2011-0755
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-02-03 01:24 UTC by Vincent Danen
Modified: 2021-02-24 16:38 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2011-03-01 13:37:40 UTC
Embargoed:


Attachments (Terms of Use)

Description Vincent Danen 2011-02-03 01:24:57 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-0755 to
the following vulnerability:

Name: CVE-2011-0755
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0755
Assigned: 20110202
Reference: CONFIRM: http://bugs.php.net/46587
Reference: CONFIRM: http://www.php.net/ChangeLog-5.php

Integer overflow in the mt_rand function in PHP before 5.3.4 might
make it easier for context-dependent attackers to predict the return
values by leveraging a script's use of a large max parameter, as
demonstrated by a value that exceeds mt_getrandmax.

Comment 1 Vincent Danen 2011-02-03 01:26:34 UTC
Statement:

Red Hat does not consider this flaw to be a security issue as arguments passed to the mt_rand function are under the full control of the script author. No trust boundary is crossed.

This flaw exists in the php53 packages versions as shipped in Red Hat Enterprise Linux 5 and the php packages versions as shipped in Red Hat Enterprise Linux 6.

Comment 2 Tomas Hoger 2011-03-01 13:37:40 UTC
Closing as not-a-security-bug.  As noted in the upstream bug, affected function returned random numbers from the specified range, but without enforcing which argument is minimal an which is maximal value.


Note You need to log in before you can comment on or make changes to this bug.