Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Simple Machines Forum < 1.1.6 Random Number Generator Credentials Disclosure



The remote host is is vulnerable to a security-bypass flaw.


The remote host is running the Simple Machines Forum (SMF), a web forum. This version of SMF is vulnerable to a flaw where it will leak the state of the random number generator. As authentication materials are created using the random number generator, an attacker can use the leaked state to determine authentication codes of other users. Note that this vulnerability only affects the Windows versions of SMF that use a simple, linear, feed-forward design for generating random numbers.


Upgrade to version 1.1.6 or higher.