Simple Machines Forum < 1.1.6 Random Number Generator Credentials Disclosure

High Nessus Network Monitor Plugin ID 4646


The remote host is is vulnerable to a security-bypass flaw.


The remote host is running the Simple Machines Forum (SMF), a web forum. This version of SMF is vulnerable to a flaw where it will leak the state of the random number generator. As authentication materials are created using the random number generator, an attacker can use the leaked state to determine authentication codes of other users. Note that this vulnerability only affects the Windows versions of SMF that use a simple, linear, feed-forward design for generating random numbers.


Upgrade to version 1.1.6 or higher.

See Also

Plugin Details

Severity: High

ID: 4646

File Name: 4646.prm

Family: CGI

Published: 2008/09/08

Modified: 2016/01/15

Dependencies: 1442

Risk Information

Risk Factor: High


Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C


Base Score: 7.3

Temporal Score: 6.8


Temporal Vector: CVSS3#E:F/RL:O/RC:C

Reference Information

CVE: CVE-2008-6971

BID: 31053

OSVDB: 47945