PT-2008-2740 · Openbsd · Openbsd

Published 2008-03-04 · Updated 2017-08-08 · CVE-2008-1146

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenBSD versions 2.8 through 4.2

Description A pseudo-random number generator (PRNG) algorithm, known as "Algorithm X3", is used in OpenBSD. This algorithm allows remote attackers to guess sensitive values, such as DNS transaction IDs, by observing a sequence of previously generated values. This issue can be leveraged for attacks like DNS cache poisoning against OpenBSD's modification of BIND.

Recommendations For OpenBSD versions 2.8 through 4.2, consider updating to a version that uses a more secure PRNG algorithm to prevent attackers from guessing sensitive values.

Fix

Related Identifiers

CVE-2008-1146

Affected Products

Openbsd

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2008-1146 · Security Note
• http://securityfocus.com/bid/27647 · Note
• http://trusteer.com/docs/OpenBSD_DNS_Cache_Poisoning_and_Multiple_OS_Predictable_IP_ID_Vulnerability.pdf · Note
• http://secunia.com/advisories/28819 · Note
• http://securiteam.com/securityreviews/5PP0H0UNGW.html · Note
• http://securityfocus.com/archive/1/487658 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/40329 · Note