PT-2008-2740 · Openbsd · Openbsd

Publicado 2008-03-04 · Atualizado 2017-08-08 · CVE-2008-1146

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenBSD versions 2.8 through 4.2

Description A pseudo-random number generator (PRNG) algorithm, known as "Algorithm X3", is used in OpenBSD. This algorithm allows remote attackers to guess sensitive values, such as DNS transaction IDs, by observing a sequence of previously generated values. This issue can be leveraged for attacks like DNS cache poisoning against OpenBSD's modification of BIND.

Recommendations For OpenBSD versions 2.8 through 4.2, consider updating to a version that uses a more secure PRNG algorithm to prevent attackers from guessing sensitive values.

Correção

Identificadores relacionados

CVE-2008-1146

Produtos afetados

Openbsd

Referências · 7

• http://securityfocus.com/bid/27647 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1146 · Nota de Segurança
• http://trusteer.com/docs/OpenBSD_DNS_Cache_Poisoning_and_Multiple_OS_Predictable_IP_ID_Vulnerability.pdf · Nota
• http://secunia.com/advisories/28819 · Nota
• http://securiteam.com/securityreviews/5PP0H0UNGW.html · Nota
• http://securityfocus.com/archive/1/487658 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/40329 · Nota