Drupal 'mt_rand()' Multiple Predictable Random Number Generator Weaknesses

Bugtraq ID:	63840
Class:	Design Error
CVE:	CVE-2013-6386
Remote:	Yes
Local:	No
Published:	Nov 20 2013 12:00AM
Updated:	Apr 13 2015 09:25PM
Credit:	David Stoline of the Drupal Security Team
Vulnerable:	Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Drupal Drupal 7.6 Drupal Drupal 7.5 Drupal Drupal 7.4 Drupal Drupal 7.3 Drupal Drupal 7.23 Drupal Drupal 7.20 Drupal Drupal 7.2 Drupal Drupal 7.19 Drupal Drupal 7.18 Drupal Drupal 7.17 Drupal Drupal 7.16 Drupal Drupal 7.15 Drupal Drupal 7.14 Drupal Drupal 7.13 Drupal Drupal 7.12 Drupal Drupal 7.11 Drupal Drupal 7.10 Drupal Drupal 7.1 Drupal Drupal 6.9 Drupal Drupal 6.8 Drupal Drupal 6.7 Drupal Drupal 6.6 Drupal Drupal 6.5 Drupal Drupal 6.4 Drupal Drupal 6.3 Drupal Drupal 6.28 Drupal Drupal 6.27 Drupal Drupal 6.26 Drupal Drupal 6.23 Drupal Drupal 6.22 Drupal Drupal 6.22 Drupal Drupal 6.21 Drupal Drupal 6.21 Drupal Drupal 6.2 Drupal Drupal 6.18 Drupal Drupal 6.17 Drupal Drupal 6.16 Drupal Drupal 6.15 Drupal Drupal 6.15 Drupal Drupal 6.14 Drupal Drupal 6.13 Drupal Drupal 6.12 Drupal Drupal 6.11 Drupal Drupal 6.10 Drupal Drupal 6.1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	Drupal Drupal 7.24 Drupal Drupal 6.29

Drupal 'mt_rand()' Multiple Predictable Random Number Generator Weaknesses

Drupal is prone to multiple predictable random number generator weaknesses.

Attackers can leverage these weaknesses to aid in brute-force attacks. Other attacks are also possible.

Drupal 6.x versions prior to 6.29 and 7.x versions prior to 7.24 are vulnerable.

Drupal 'mt_rand()' Multiple Predictable Random Number Generator Weaknesses

An attacker can exploit these issues using readily available tools.