CVE-2008-2108

CVE-2008-2108 describes a critical vulnerability in PHP 4.x (before 4.4.8) and 5.x (before 5.2.5) on 64-bit systems, where the GENERATE_SEED macro produces insufficient entropy (only 24 bits) for the rand and mt_rand functions due to a precision issue during multiplication. This weakness significantly simplifies brute-force attacks against protection mechanisms relying on these functions. The vulnerability carries a CVSS score of 9.8 (CRITICAL), indicating a network-exploitable flaw with low attack complexity, requiring no user interaction or privileges, and leading to high impacts on confidentiality, integrity, and availability. Its FAUCET Risk Score is 94/100, and it is categorized under CWE-331 (Insufficient Entropy). While there is no evidence of active exploitation, nor are there known Metasploit or ExploitDB modules, the vulnerability has garnered significant community discussion with 10 mentions, suggesting awareness and potential interest. It is not listed in CISA's KEV catalog and is considered inactive on the Hot List.