Lucene search

[email protected]CVE-2008-1147

HistoryMar 04, 2008 - 11:44 p.m.

CVE-2008-1147

2008-03-0423:44:00

[email protected]

web.nvd.nist.gov

cve-2008-1147

prng

xor

2-bit random hops

openbsd

mac os x

freebsd

dragonflybsd

remote attackers

ip fragmentation ids

tcp packets

os fingerprinting

nvd

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

6.9 Medium

AI Score

Confidence

Low

0.015 Low

EPSS

Percentile

87.0%

JSON

A certain pseudo-random number generator (PRNG) algorithm that uses XOR and 2-bit random hops (aka “Algorithm X2”), as used in OpenBSD 2.6 through 3.4, Mac OS X 10 through 10.5.1, FreeBSD 4.4 through 7.0, and DragonFlyBSD 1.0 through 1.10.1, allows remote attackers to guess sensitive values such as IP fragmentation IDs by observing a sequence of previously generated values. NOTE: this issue can be leveraged for attacks such as injection into TCP packets and OS fingerprinting.

Affected configurations

NVD

Node

applemac_os_xMatch10.0

applemac_os_xMatch10.0.1

applemac_os_xMatch10.0.2

applemac_os_xMatch10.0.3

applemac_os_xMatch10.0.4

applemac_os_xMatch10.1

applemac_os_xMatch10.1.1

applemac_os_xMatch10.1.2

applemac_os_xMatch10.1.3

applemac_os_xMatch10.1.4

applemac_os_xMatch10.1.5

applemac_os_xMatch10.2

applemac_os_xMatch10.2.1

applemac_os_xMatch10.2.2

applemac_os_xMatch10.2.3

applemac_os_xMatch10.2.4

applemac_os_xMatch10.2.5

applemac_os_xMatch10.2.6

applemac_os_xMatch10.2.7

applemac_os_xMatch10.2.8

applemac_os_xMatch10.3

applemac_os_xMatch10.3.1

applemac_os_xMatch10.3.2

applemac_os_xMatch10.3.3

applemac_os_xMatch10.3.4

applemac_os_xMatch10.3.5

applemac_os_xMatch10.3.6

applemac_os_xMatch10.3.7

applemac_os_xMatch10.3.8

applemac_os_xMatch10.3.9

applemac_os_xMatch10.4

applemac_os_xMatch10.4.1

applemac_os_xMatch10.4.2

applemac_os_xMatch10.4.3

applemac_os_xMatch10.4.4

applemac_os_xMatch10.4.5

applemac_os_xMatch10.4.6

applemac_os_xMatch10.4.7

applemac_os_xMatch10.4.8

applemac_os_xMatch10.4.9

applemac_os_xMatch10.4.10

applemac_os_xMatch10.4.11

applemac_os_xMatch10.5

applemac_os_xMatch10.5.1

applemac_os_x_serverMatch10.0

applemac_os_x_serverMatch10.1

applemac_os_x_serverMatch10.1.1

applemac_os_x_serverMatch10.1.2

applemac_os_x_serverMatch10.1.3

applemac_os_x_serverMatch10.1.4

applemac_os_x_serverMatch10.1.5

applemac_os_x_serverMatch10.2

applemac_os_x_serverMatch10.2.1

applemac_os_x_serverMatch10.2.2

applemac_os_x_serverMatch10.2.3

applemac_os_x_serverMatch10.2.4

applemac_os_x_serverMatch10.2.5

applemac_os_x_serverMatch10.2.6

applemac_os_x_serverMatch10.2.7

applemac_os_x_serverMatch10.2.8

applemac_os_x_serverMatch10.3

applemac_os_x_serverMatch10.3.1

applemac_os_x_serverMatch10.3.2

applemac_os_x_serverMatch10.3.3

applemac_os_x_serverMatch10.3.4

applemac_os_x_serverMatch10.3.5

applemac_os_x_serverMatch10.3.6

applemac_os_x_serverMatch10.3.7

applemac_os_x_serverMatch10.3.8

applemac_os_x_serverMatch10.3.9

applemac_os_x_serverMatch10.4

applemac_os_x_serverMatch10.4.1

applemac_os_x_serverMatch10.4.2

applemac_os_x_serverMatch10.4.3

applemac_os_x_serverMatch10.4.4

applemac_os_x_serverMatch10.4.5

applemac_os_x_serverMatch10.4.6

applemac_os_x_serverMatch10.4.7

applemac_os_x_serverMatch10.4.8

applemac_os_x_serverMatch10.4.9

applemac_os_x_serverMatch10.4.10

applemac_os_x_serverMatch10.4.11

applemac_os_x_serverMatch10.5

dragonflybsddragonflybsdMatch1.0

dragonflybsddragonflybsdMatch1.1

dragonflybsddragonflybsdMatch1.2

dragonflybsddragonflybsdMatch1.10.1

freebsdfreebsdMatch4.4

freebsdfreebsdMatch4.4release_p42

freebsdfreebsdMatch4.4releng

freebsdfreebsdMatch4.4stable

freebsdfreebsdMatch4.5

freebsdfreebsdMatch4.5release

freebsdfreebsdMatch4.5release_p32

freebsdfreebsdMatch4.5releng

freebsdfreebsdMatch4.5stable

freebsdfreebsdMatch4.6

freebsdfreebsdMatch4.6release

freebsdfreebsdMatch4.6release_p20

freebsdfreebsdMatch4.6releng

freebsdfreebsdMatch4.6stable

freebsdfreebsdMatch4.6.2

freebsdfreebsdMatch4.7

freebsdfreebsdMatch4.7release

freebsdfreebsdMatch4.7release_p17

freebsdfreebsdMatch4.7releng

freebsdfreebsdMatch4.7stable

freebsdfreebsdMatch4.8

freebsdfreebsdMatch4.8release_p7

freebsdfreebsdMatch4.8releng

freebsdfreebsdMatch4.8_prerelease

freebsdfreebsdMatch4.9

freebsdfreebsdMatch4.9releng

freebsdfreebsdMatch4.9_prerelease

freebsdfreebsdMatch4.10

freebsdfreebsdMatch4.10release

freebsdfreebsdMatch4.10release_p8

freebsdfreebsdMatch4.10releng

freebsdfreebsdMatch4.10_prerelease

freebsdfreebsdMatch4.11release_p3

freebsdfreebsdMatch4.11releng

freebsdfreebsdMatch4.11stable

freebsdfreebsdMatch4.11_p20_release

freebsdfreebsdMatch4.11_release

freebsdfreebsdMatch5.0

freebsdfreebsdMatch5.0alpha

freebsdfreebsdMatch5.0release_p14

freebsdfreebsdMatch5.0releng

freebsdfreebsdMatch5.1

freebsdfreebsdMatch5.1alpha

freebsdfreebsdMatch5.1release

freebsdfreebsdMatch5.1release_p5

freebsdfreebsdMatch5.1releng

freebsdfreebsdMatch5.2

freebsdfreebsdMatch5.2.1release

freebsdfreebsdMatch5.2.1releng

freebsdfreebsdMatch5.3

freebsdfreebsdMatch5.3release

freebsdfreebsdMatch5.3releng

freebsdfreebsdMatch5.3stable

freebsdfreebsdMatch5.4release

freebsdfreebsdMatch5.4releng

freebsdfreebsdMatch5.4stable

freebsdfreebsdMatch5.5_release

freebsdfreebsdMatch5.5_stable

freebsdfreebsdMatch6.0

freebsdfreebsdMatch6.0release

freebsdfreebsdMatch6.0stable

freebsdfreebsdMatch6.0_p5_release

freebsdfreebsdMatch6.1

freebsdfreebsdMatch6.1release

freebsdfreebsdMatch6.1release_p10

freebsdfreebsdMatch6.1stable

freebsdfreebsdMatch6.2

freebsdfreebsdMatch6.2stable

freebsdfreebsdMatch6.2_releng

freebsdfreebsdMatch6.3

freebsdfreebsdMatch6.3_releng

freebsdfreebsdMatch7.0pre-release

freebsdfreebsdMatch7.0_beta4

freebsdfreebsdMatch7.0_releng

netbsdnetbsdMatch1.6.2

netbsdnetbsdMatch2.0

netbsdnetbsdMatch2.0.1

netbsdnetbsdMatch2.0.2

netbsdnetbsdMatch2.0.3

netbsdnetbsdMatch2.0.4

netbsdnetbsdMatch2.1

netbsdnetbsdMatch2.1.1

netbsdnetbsdMatch3.0.1

netbsdnetbsdMatch3.0.2

netbsdnetbsdMatch3.1

netbsdnetbsdMatch3.1rc1

netbsdnetbsdMatch3.1rc3

netbsdnetbsdMatch4.0

netbsdnetbsdMatch4.0beta

netbsdnetbsdMatch4.0beta2

openbsdopenbsdMatch2.6

openbsdopenbsdMatch2.7

openbsdopenbsdMatch2.8

openbsdopenbsdMatch2.9

openbsdopenbsdMatch3.0

openbsdopenbsdMatch3.1

openbsdopenbsdMatch3.2

openbsdopenbsdMatch3.3

openbsdopenbsdMatch3.4

openbsdopenbsdMatch3.5

openbsdopenbsdMatch3.6

openbsdopenbsdMatch3.7

openbsdopenbsdMatch3.8

openbsdopenbsdMatch3.9

openbsdopenbsdMatch4.0

openbsdopenbsdMatch4.1

openbsdopenbsdMatch4.2

AND

cosmicperldirectory_proMatch10.0.3

darwindarwinMatch1.0

darwindarwinMatch9.1

navisionfinancials_serverMatch3.0

CPENameOperatorVersion
cosmicperl:directory_procosmicperl directory proeq10.0.3
darwin:darwindarwineq1.0
darwin:darwindarwineq9.1
navision:financials_servernavision financials servereq3.0

CPE	Name	Operator	Version
cosmicperl:directory_pro	cosmicperl directory pro	eq	10.0.3
darwin:darwin	darwin	eq	1.0
darwin:darwin	darwin	eq	9.1
navision:financials_server	navision financials server	eq	3.0

References

seclists.org/bugtraq/2008/Feb/0052.html

seclists.org/bugtraq/2008/Feb/0063.html

secunia.com/advisories/28819

www.freebsd.org/cgi/cvsweb.cgi/src/sys/netinet/ip_id.c?rev=1.10%3Bcontenttype=

www.securiteam.com/securityreviews/5PP0H0UNGW.html

www.securityfocus.com/archive/1/487658

www.securityfocus.com/bid/27647

www.trusteer.com/docs/OpenBSD_DNS_Cache_Poisoning_and_Multiple_OS_Predictable_IP_ID_Vulnerability.pdf

exchange.xforce.ibmcloud.com/vulnerabilities/40329

exchange.xforce.ibmcloud.com/vulnerabilities/41155

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

6.9 Medium

AI Score

Confidence

Low

0.015 Low

EPSS

Percentile

87.0%

JSON

Related for CVE-2008-1147

prion1 nvd1 cvelist1