PT-2014-3402 · Openssl+1 · Openssl+1

Alexander Dymo + 1 · Publicado 2014-04-29 · Atualizado 2014-04-30 · CVE-2013-7373

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android versions prior to 4.4

Description The issue arises from the improper seeding of the OpenSSL PRNG in Android, making it easier for attackers to defeat cryptographic protection mechanisms. This is particularly concerning when the PRNG is used within multiple applications.

Recommendations For Android versions prior to 4.4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-7373

Produtos afetados

Android

Openssl

Referências · 6

• http://emboss.github.io/blog/2013/08/21/openssl-prng-is-not-really-fork-safe · Nota
• http://android-developers.blogspot.com.au/2013/08/some-securerandom-thoughts.html · Nota
• http://marc.info/?l=openssl-dev&m=130298304903422&w=2 · Nota
• http://reddit.com/r/Android/comments/1k6f03/due_to_a_serious_encryptionrng_flaw_in_android/cblvum5 · Nota
• http://marc.info/?l=openssl-dev&m=130289811108150&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-7373 · Nota de Segurança