CVE-2006-0632 The gen_rand_string function in phpBB 2.0.19 uses insufficiently random data (small value space) to create the activation key ("validation ID") that is sent by e-mail when establishing a password, whi...
MediumCVSS 6.4
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The gen_rand_string function in phpBB 2.0.19 uses insufficiently random data (small value space) to create the activation key ("validation ID") that is sent by e-mail when establishing a password, which makes it easier for remote attackers to obtain the key and modify passwords for existing accounts or create new accounts.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpbb group phpbb | = 2.0.0 | No fix listed |
| phpbb group phpbb | = 2.0.1 | No fix listed |
| phpbb group phpbb | = 2.0.2 | No fix listed |
| phpbb group phpbb | = 2.0.3 | No fix listed |
| phpbb group phpbb | = 2.0.4 | No fix listed |
| phpbb group phpbb | = 2.0.5 | No fix listed |
| phpbb group phpbb | = 2.0.6 | No fix listed |
| phpbb group phpbb | = 2.0.6c | No fix listed |
| phpbb group phpbb | = 2.0.6d | No fix listed |
| phpbb group phpbb | = 2.0.7 | No fix listed |
| phpbb group phpbb | = 2.0.7a | No fix listed |
| phpbb group phpbb | = 2.0.8 | No fix listed |
| phpbb group phpbb | = 2.0.8a | No fix listed |
| phpbb group phpbb | = 2.0.9 | No fix listed |
| phpbb group phpbb | = 2.0.10 | No fix listed |
| phpbb group phpbb | = 2.0.11 | No fix listed |
| phpbb group phpbb | = 2.0.12 | No fix listed |
| phpbb group phpbb | = 2.0.13 | No fix listed |
| phpbb group phpbb | = 2.0.14 | No fix listed |
| phpbb group phpbb | = 2.0.15 | No fix listed |
| phpbb group phpbb | = 2.0.16 | No fix listed |
| phpbb group phpbb | = 2.0.17 | No fix listed |
| phpbb group phpbb | = 2.0.18 | No fix listed |
| phpbb group phpbb | = 2.0.19 | No fix listed |
| phpbb group phpbb | = 2.0_beta1 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| phpbb group phpbb | = 2.0_rc1 | No fix listed |
| phpbb group phpbb | = 2.0_rc2 | No fix listed |
| phpbb group phpbb | = 2.0_rc3 | No fix listed |
| phpbb group phpbb | = 2.0_rc4 | No fix listed |
References
- 18727 third-party-advisory
- 22949 vdb-entry
- www.r-security.net exploit
- 20060205 Easily exploitable Pseudo Random Number generator in phpbb version 2.0.19 and under. mailing-list
- ADV-2006-0461 vdb-entry
- phpbb-weak-rnd(24573) vdb-entry