icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons_061

Simple Machines Forum < 1.1.6 Random Number Generator Credentials Disclosure

High

Synopsis

The remote host is is vulnerable to a security-bypass flaw.

Description

The remote host is running the Simple Machines Forum (SMF), a web forum. This version of SMF is vulnerable to a flaw where it will leak the state of the random number generator. As authentication materials are created using the random number generator, an attacker can use the leaked state to determine authentication codes of other users. Note that this vulnerability only affects the Windows versions of SMF that use a simple, linear, feed-forward design for generating random numbers.

Solution

Upgrade to version 1.1.6 or higher.