PT-2010-4791 · Mozilla · Firefox+1

Published 2010-09-15 · Updated 2017-09-19 · CVE-2010-3400

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 3.5.x through 3.5.9 Mozilla Firefox versions 3.6.x through 3.6.3 SeaMonkey versions prior to 2.0.5

Description The issue is related to the js InitRandom function in the JavaScript implementation, which uses the current time for seeding a random number generator. This makes it easier for remote attackers to guess the seed value via a brute-force attack.

Recommendations For Mozilla Firefox versions 3.5.x through 3.5.9, update to version 3.5.10 or later. For Mozilla Firefox versions 3.6.x through 3.6.3, update to version 3.6.4 or later. For SeaMonkey versions prior to 2.0.5, update to version 2.0.5 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2010-3400

Affected Products

Firefox

Seamonkey

References · 3

• https://bugzilla.mozilla.org/show_bug.cgi?id=475585 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2010-3400 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7339 · Note