PT-2008-6712 · Gnu · Gnu Classpath

Florian Weimer · Publicado 2008-12-17 · Atualizado 2017-08-08 · CVE-2008-5659

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU Classpath versions 0.97.2 and earlier

Description The issue concerns the gnu.java.security.util.PRNG class, which uses a predictable seed based on the system time. This predictability makes it easier for attackers to conduct brute force attacks against cryptographic routines that utilize this class for randomness. An example of such an attack is against DSA private keys.

Recommendations For GNU Classpath versions 0.97.2 and earlier, consider updating to a version that uses a more secure method for generating random numbers, as the current implementation poses a significant risk to the security of cryptographic operations.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2008-5659

Produtos afetados

Gnu Classpath

Referências · 6

• 🔥 https://exploit-db.com/exploits/32674 · Exploit
• 🔥 https://exploit-db.com/exploits/32673 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5659 · Nota de Segurança
• http://openwall.com/lists/oss-security/2008/12/06/2 · Nota
• http://gcc.gnu.org/bugzilla/show_bug.cgi?id=38417 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47574 · Nota