PT-2005-3917 · Securew2 · Securew2

Published 2005-09-27 · Updated 2008-09-05 · CVE-2005-3087

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SecureW2 version 3.0

Description The issue concerns the use of weak random number generators, specifically rand and srand from system time, during the generation of the pre-master secret (PMS) in the TLS implementation. This weakness makes it easier for attackers to guess the secret and decrypt sensitive data.

Recommendations For SecureW2 version 3.0, consider updating the random number generation mechanism to a more secure alternative to prevent attackers from guessing the pre-master secret. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-3087

Affected Products

Securew2

References · 3

• http://secunia.com/advisories/16909 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3087 · Security Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/037352.html · Vendor Advisory