PT-2023-10325 · Enigma · Enigmax

Published 2023-01-02 · Updated 2024-05-17 · CVE-2016-15006

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions enigmaX versions prior to 2.3

Description A problematic issue has been found in the Scrambling Table Handler component, specifically affecting the getSeed function of the main.c file. This leads to a predictable seed in the pseudo-random number generator (prng), which can be exploited remotely. The complexity of an attack is rather high, and the exploitation is known to be difficult.

Recommendations For versions prior to 2.3, upgrade to version 2.3 to address this issue. As a temporary workaround, consider restricting access to the getSeed function of the Scrambling Table Handler component until the upgrade is applied.

Fix

Weakness Enumeration

CWE-337

Related Identifiers

CVE-2016-15006

Affected Products

Enigmax

References · 6

• https://github.com/pfmonville/enigmaX/releases/tag/2.3 · Patch
• https://github.com/pfmonville/enigmaX/commit/922bf90ca14a681629ba0b807a997a81d70225b5 · Patch
• https://osv.dev/vulnerability/CVE-2016-15006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-15006 · Security Note
• https://vuldb.com/?ctiid.217181 · Note
• https://vuldb.com/?id.217181 · Note