PT-2011-2617 · Ericsson · Erlang/Otp

Geoff Cant · Published 2011-05-31 · Updated 2023-09-25 · CVE-2011-0766

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Crypto application versions prior to 2.0.2.2 SSH versions prior to 2.0.5 Erlang/OTP ssh library versions prior to R14B03

Description The random number generator uses predictable seeds based on the current time, making it easier for remote attackers to guess DSA host and SSH session keys.

Recommendations For Crypto application versions prior to 2.0.2.2, update to version 2.0.2.2 or later. For SSH versions prior to 2.0.5, update to version 2.0.5 or later. For Erlang/OTP ssh library versions prior to R14B03, update to version R14B03 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2011-0766

Affected Products

Erlang/Otp

References · 9

• https://github.com/erlang/otp/commit/f228601de45c5b53241b103af6616453c50885a5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-0766 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-0766 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-0766 · Vendor Advisory
• http://secunia.com/advisories/44709 · Vendor Advisory
• http://kb.cert.org/vuls/id/178990 · Patch
• https://osv.dev/vulnerability/CVE-2011-0766 · Vendor Advisory
• https://t.me/cvenotify/58553 · Telegram Post
• http://securityfocus.com/bid/47980 · Note