Index: t3lib/class.t3lib_userauth.php
===================================================================
--- t3lib/class.t3lib_userauth.php	(revision 8265)
+++ t3lib/class.t3lib_userauth.php	(working copy)
@@ -686,7 +686,7 @@
 	 * @return	string		The new session ID
 	 */
 	public function createSessionId() {
-		return substr(md5(uniqid('') . getmypid()), 0, $this->hash_length);
+		return t3lib_div::generateRandomString($this->hash_length);
 	}
 
 
Index: t3lib/class.t3lib_div.php
===================================================================
--- t3lib/class.t3lib_div.php	(revision 8265)
+++ t3lib/class.t3lib_div.php	(working copy)
@@ -1516,16 +1516,35 @@
 		if (TYPO3_OS != 'WIN' && ($fh = @fopen('/dev/urandom', 'rb'))) {
 			$output = fread($fh, $count);
 			fclose($fh);
+		} elseif (TYPO3_OS == 'WIN' && function_exists('mcrypt_create_iv') && version_compare(PHP_VERSION, '5.3.0', '>=')) {
+			$output = mcrypt_create_iv($count, MCRYPT_DEV_URANDOM);
+		} elseif (TYPO3_OS == 'WIN' && version_compare(PHP_VERSION, '5.3.0', '>=') && function_exists('openssl_random_pseudo_bytes')) {
+			$isStrong = null;
+			$output = openssl_random_pseudo_bytes($count, $isStrong);
+				// skip ssl since it wasn't using the strong algo
+			if ($isStrong !== TRUE) {
+				$output = '';
+			}
 		}
 
-			// fallback if /dev/urandom is not available
+			// Try to use windows COM API if we did not get random bytes yet
+		if (!isset($output{$count - 1}) && TYPO3_OS == 'WIN' && class_exists('COM')) {
+			try {
+				$com = new COM('CAPICOM.Utilities.1');
+				$output = $com->GetRandom($count, 1);
+			} catch(Exception $e) {
+			}
+		}
+
+			// fallback if other random byte generation failed until now
 		if (!isset($output{$count - 1})) {
 				// We initialize with the somewhat random.
 			$randomState = $GLOBALS['TYPO3_CONF_VARS']['SYS']['encryptionKey']
-							. microtime() . getmypid();
+							. base_convert(memory_get_usage() % pow(10,6), 10, 2)
+							. microtime() . uniqid('') . getmypid();
 			while (!isset($output{$count - 1})) {
-				$randomState = md5(microtime() . mt_rand() . $randomState);
-				$output .= md5(mt_rand() . $randomState, true);
+				$randomState = sha1(microtime() . mt_rand() . $randomState);
+				$output .= sha1(mt_rand() . $randomState, true);
 			}
 			$output = substr($output, strlen($output) - $count, $count);
 		}
@@ -1533,6 +1552,17 @@
 	}
 
 	/**
+	 * Returns a hex representation of a random byte string.
+	 *
+	 * @param		integer  Number of hex characters to return
+	 * @return		string   Random Bytes
+	 */
+	public static function generateRandomString($count)
+	{
+		return substr(bin2hex(self::generateRandomBytes(intval(($count + 1) / 2))), 0, $count);
+	}
+
+	/**
 	 * Returns a given string with underscores as UpperCamelCase.
 	 * Example: Converts blog_example to BlogExample
 	 *