PT-2007-6959 · Microsoft · Windows 2000

Published 2007-11-20 · Updated 2008-09-05 · CVE-2007-6043

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows 2000

Description The issue affects the CryptGenRandom function, which generates predictable values. This predictability can be exploited by context-dependent attackers to reduce the effectiveness of cryptographic mechanisms. Specifically, it has been demonstrated that attacks on forward security and backward security can be facilitated, related to the use of eight instances of the RC4 cipher.

Recommendations For Microsoft Windows 2000, consider applying configuration changes to enhance the security of cryptographic mechanisms, such as using alternative random number generators or implementing additional security protocols to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2007-6043

Affected Products

Windows 2000

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-6043 · Security Note
• http://eprint.iacr.org/2007/419.pdf · Note
• http://computerworld.com.au/index.php/id%3B1165210682%3Bfp%3B2%3Bfpid%3B1 · Note
• http://securityfocus.com/bid/26495 · Note