CVE-2008-5162

The arc4random function in the kernel in FreeBSD 6.3 through 7.1 does not have a proper entropy source for a short time period immediately after boot, which makes it easier for attackers to predict the function's return values and conduct certain attacks against the GEOM framework and various network protocols, related to the Yarrow random number generator.

CVSS v2.0 6.9 MEDIUM

6.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://security.freebsd.org/advisories/FreeBSD-SA-08:11.arc4random.asc	Vendor Advisory
http://securitytracker.com/id?1021276
http://www.securityfocus.com/bid/32447
http://secunia.com/advisories/32871
http://osvdb.org/50137

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:freebsd:freebsd:7.1:::::::*
	cpe:2.3:o:freebsd:freebsd:6.4:::::::*
	cpe:2.3:o:freebsd:freebsd:7.0:::::::*
	cpe:2.3:o:freebsd:freebsd:6.3:::::::*

Information

Published : 2008-11-26 23:30

Updated : 2008-12-03 06:46

NVD link : CVE-2008-5162

Mitre link : CVE-2008-5162

JSON object : View

Products Affected

freebsd

freebsd

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-310

Cryptographic Issues

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://security.freebsd.org/advisories/FreeBSD-SA-08:11.arc4random.asc", "name": "FreeBSD-SA-08:11", "tags": ["Vendor Advisory"], "refsource": "FREEBSD"}, {"url": "http://securitytracker.com/id?1021276", "name": "1021276", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.securityfocus.com/bid/32447", "name": "32447", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/32871", "name": "32871", "tags": [], "refsource": "SECUNIA"}, {"url": "http://osvdb.org/50137", "name": "50137", "tags": [], "refsource": "OSVDB"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The arc4random function in the kernel in FreeBSD 6.3 through 7.1 does not have a proper entropy source for a short time period immediately after boot, which makes it easier for attackers to predict the function's return values and conduct certain attacks against the GEOM framework and various network protocols, related to the Yarrow random number generator."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-310"}, {"lang": "en", "value": "CWE-362"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2008-5162", "ASSIGNER": "secteam@freebsd.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "MEDIUM", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2008-11-26T23:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:freebsd:freebsd:7.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:freebsd:freebsd:6.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:freebsd:freebsd:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:freebsd:freebsd:6.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2008-12-03T06:46Z"}