PT-2014-3402 · Openssl+1 · Openssl+1

Alexander Dymo + 1 · Published 2014-04-29 · Updated 2014-04-30 · CVE-2013-7373

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android versions prior to 4.4

Description The issue arises from the improper seeding of the OpenSSL PRNG in Android, making it easier for attackers to defeat cryptographic protection mechanisms. This is particularly concerning when the PRNG is used within multiple applications.

Recommendations For Android versions prior to 4.4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-7373

Affected Products

Android

Openssl

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-7373 · Security Note
• http://emboss.github.io/blog/2013/08/21/openssl-prng-is-not-really-fork-safe · Note
• http://android-developers.blogspot.com.au/2013/08/some-securerandom-thoughts.html · Note
• http://marc.info/?l=openssl-dev&m=130298304903422&w=2 · Note
• http://reddit.com/r/Android/comments/1k6f03/due_to_a_serious_encryptionrng_flaw_in_android/cblvum5 · Note
• http://marc.info/?l=openssl-dev&m=130289811108150&w=2 · Note