The (1) rand and (2) mt_rand functions in PHP 5.2.6 do not produce cryptographically strong random numbers, which allows attackers to leverage exposures in products that rely on these functions for security-relevant functionality, as demonstrated by the password-reset functionality in Joomla! 1.5.x and WordPress before 2.6.2, a different vulnerability than CVE-2008-2107, CVE-2008-2108, and CVE-2008-4102.

http://wordpress.org/development/2008/09/wordpress-262/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Wordpress development team reports :

With open registration enabled, it is possible in WordPress versions 2.6.1 and earlier to craft a username such that it will allow resetting another users password to a randomly generated password. The randomly generated password is not disclosed to the attacker, so this problem by itself is annoying but not a security exploit. However, this attack coupled with a weakness in the random number seeding in mt_rand() could be used to predict the randomly generated password.

The version of WordPress installed on the remote host is vulnerable to a flaw that would allow any user to reset the password of any other user account.  After resetting the password, the newly reset password would be sent to the email address linked to the account.   

According to its banner, the version of PHP installed on the remote host is older than 5.2.5.  Such versions may be affected by various issues, including but not limited to several buffer overflows.

ID	Name	Product	Family	Severity
34181	Fedora 9 : wordpress-2.6.2-1.fc9 (2008-7902)	Nessus	Fedora Local Security Checks	medium
34173	Fedora 8 : wordpress-2.6.2-1.fc8 (2008-7760)	Nessus	Fedora Local Security Checks	medium
34152	FreeBSD : wordpress -- remote privilege escalation (884fced7-7f1c-11dd-a66a-0019666436c2)	Nessus	FreeBSD Local Security Checks	medium
4648	WordPress < 2.6.2 Administrative Password Reset	Nessus Network Monitor	CGI	medium
28181	PHP < 5.2.5 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2008-4107

critical

Tenable Plugins

medium

medium

medium

medium

medium