Description
The gen_rand_string function in phpBB 2.0.19 uses insufficiently random data (small value space) to create the activation key ("validation ID") that is sent by e-mail when establishing a password, which makes it easier for remote attackers to obtain the key and modify passwords for existing accounts or create new accounts.
References
- 20060205 Easily exploitable Pseudo Random Number generator in phpbb version 2.0.19 and under. mailing-list
- http://www.r-security.net/tutorials/view/readtutorial.php?id=4
- 18727 third-party-advisory
- ADV-2006-0461 vdb-entry
- phpbb-weak-rnd(24573) vdb-entry
- 22949 vdb-entry