Simple Machines Forum < 1.1.6 Random Number Generator Credentials Disclosure
High Nessus Network Monitor Plugin ID 4646
SynopsisThe remote host is is vulnerable to a security-bypass flaw.
DescriptionThe remote host is running the Simple Machines Forum (SMF), a web forum. This version of SMF is vulnerable to a flaw where it will leak the state of the random number generator. As authentication materials are created using the random number generator, an attacker can use the leaked state to determine authentication codes of other users. Note that this vulnerability only affects the Windows versions of SMF that use a simple, linear, feed-forward design for generating random numbers.
SolutionUpgrade to version 1.1.6 or higher.