CVE-2007-6150

2007-11-3001:46:00

CWE-200

[email protected]

web.nvd.nist.gov

freebsd

internal state tracking

vulnerability

random devices

urandom devices

cve-2007-6150

nvd

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.3

Confidence

Low

EPSS

Percentile

5.1%

JSON

The “internal state tracking” code for the random and urandom devices in FreeBSD 5.5, 6.1 through 6.3, and 7.0 beta 4 allows local users to obtain portions of previously-accessed random values, which could be leveraged to bypass protection mechanisms that rely on secrecy of those values.

Affected configurations

NVD

Node

freebsdfreebsdMatch5.5

freebsdfreebsdMatch6.1

freebsdfreebsdMatch6.2

freebsdfreebsdMatch6.3

freebsdfreebsdMatch7.0beta_4

VendorProductVersionCPE
freebsdfreebsd6.3cpe:/o:freebsd:freebsd:6.3:::
freebsdfreebsd6.1cpe:/o:freebsd:freebsd:6.1:::
freebsdfreebsd5.5cpe:/o:freebsd:freebsd:5.5:::
freebsdfreebsd7.0cpe:/o:freebsd:freebsd:7.0:beta_4::
freebsdfreebsd6.2cpe:/o:freebsd:freebsd:6.2:::

Vendor	Product	Version	CPE
freebsd	freebsd	6.3	cpe:/o:freebsd:freebsd:6.3:::
freebsd	freebsd	6.1	cpe:/o:freebsd:freebsd:6.1:::
freebsd	freebsd	5.5	cpe:/o:freebsd:freebsd:5.5:::
freebsd	freebsd	7.0	cpe:/o:freebsd:freebsd:7.0:beta_4::
freebsd	freebsd	6.2	cpe:/o:freebsd:freebsd:6.2:::