PT-2001-2283 · Openssl · Openssl

Published 2001-07-10 · Updated 2017-10-10 · CVE-2001-1141

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 0.9.6b

Description The issue concerns the Pseudo-Random Number Generator (PRNG) in SSLeay and OpenSSL, which allows attackers to determine the internal state information by using the output of small PRNG requests. This could potentially be used by attackers to predict future pseudo-random numbers.

Recommendations For versions prior to 0.9.6b, update to version 0.9.6b or later to resolve the issue.

Fix

Related Identifiers

CVE-2001-1141

Affected Products

Openssl

References · 12

• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000418 · Vendor Advisory
• http://linuxsecurity.com/advisories/other_advisory-1483.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2001-051.html · Vendor Advisory
• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2001-013.txt.asc · Vendor Advisory
• http://linux-mandrake.com/en/security/2001/MDKSA-2001-065.php3?dis=8.0 · Vendor Advisory
• http://securityfocus.com/advisories/3475 · Vendor Advisory
• http://securityfocus.com/archive/1/195829 · Vendor Advisory
• http://securityfocus.com/bid/3004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1141 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1141 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6823 · Note
• http://osvdb.org/853 · Note