PT-2008-1041 · Openssl · Openssl

Hitz + 1 · Published 2008-05-13 · Updated 2026-01-27 · CVE-2008-0166

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSSL versions 0.9.8c-1 through 0.9.8g-9

Description The issue concerns a random number generator in OpenSSL that generates predictable numbers, making it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys. This affects Debian-based operating systems. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

Recommendations For OpenSSL versions 0.9.8c-1 through 0.9.8g-9, update to a version newer than 0.9.8g-9 to resolve the issue. At the moment, there is no information about additional mitigation measures.

Exploit

Fix

Weakness Enumeration

CWE-338

Related Identifiers

BDU:2015-04116

CVE-2008-0166

DSA-1571-1

DSA-1576-1

OPENSSLUNAUTHORIZEDACCESS

Affected Products

Openssl

References · 44

• 🔥 https://github.com/g0tmi1k/debian-ssh · Exploit
• 🔥 https://github.com/badkeys/debianopenssl · Exploit
• 🔥 https://github.com/demining/Vulnerable-to-Debian-OpenSSL-bug-CVE-2008-0166 · Exploit
• 🔥 https://exploit-db.com/exploits/5632 · Exploit
• 🔥 https://exploit-db.com/exploits/5720 · Exploit
• 🔥 https://exploit-db.com/exploits/5622 · Exploit
• 🔥 https://github.com/QasimShahbaz21/CVE-Exploit-Research-Development · Exploit
• 🔥 http://securityfocus.com/bid/29179 · Exploit
• http://secunia.com/advisories/30239 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04116 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-0166 · Security Note
• http://ubuntu.com/usn/usn-612-4 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-0166 · Vendor Advisory
• http://secunia.com/advisories/30221 · Vendor Advisory
• http://secunia.com/advisories/30136 · Vendor Advisory