PT-2007-6959 · Microsoft · Windows 2000

Publicado 2007-11-20 · Atualizado 2008-09-05 · CVE-2007-6043

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows 2000

Description The issue affects the CryptGenRandom function, which generates predictable values. This predictability can be exploited by context-dependent attackers to reduce the effectiveness of cryptographic mechanisms. Specifically, it has been demonstrated that attacks on forward security and backward security can be facilitated, related to the use of eight instances of the RC4 cipher.

Recommendations For Microsoft Windows 2000, consider applying configuration changes to enhance the security of cryptographic mechanisms, such as using alternative random number generators or implementing additional security protocols to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2007-6043

Produtos afetados

Windows 2000

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-6043 · Nota de Segurança
• http://eprint.iacr.org/2007/419.pdf · Nota
• http://computerworld.com.au/index.php/id%3B1165210682%3Bfp%3B2%3Bfpid%3B1 · Nota
• http://securityfocus.com/bid/26495 · Nota