PT-2008-6712 · Gnu · Gnu Classpath

Florian Weimer · Published 2008-12-17 · Updated 2017-08-08 · CVE-2008-5659

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU Classpath versions 0.97.2 and earlier

Description The issue concerns the gnu.java.security.util.PRNG class, which uses a predictable seed based on the system time. This predictability makes it easier for attackers to conduct brute force attacks against cryptographic routines that utilize this class for randomness. An example of such an attack is against DSA private keys.

Recommendations For GNU Classpath versions 0.97.2 and earlier, consider updating to a version that uses a more secure method for generating random numbers, as the current implementation poses a significant risk to the security of cryptographic operations.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2008-5659

Affected Products

Gnu Classpath

References · 6

• 🔥 https://exploit-db.com/exploits/32674 · Exploit
• 🔥 https://exploit-db.com/exploits/32673 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5659 · Security Note
• http://openwall.com/lists/oss-security/2008/12/06/2 · Note
• http://gcc.gnu.org/bugzilla/show_bug.cgi?id=38417 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47574 · Note