Lucene search

[email protected]CVE-2008-5659

HistoryDec 17, 2008 - 8:30 p.m.

CVE-2008-5659

2008-12-1720:30:01

CWE-310

[email protected]

web.nvd.nist.gov

cve-2008-5659

system time

prng class

gnu classpath

brute force attacks

cryptographic routines

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

6.4 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.0%

JSON

The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.

Affected configurations

NVD

Node

gnuclasspathRange≤0.97.2

gnuclasspathMatch0.6

gnuclasspathMatch0.7

gnuclasspathMatch0.8

gnuclasspathMatch0.9

gnuclasspathMatch0.10

gnuclasspathMatch0.11

gnuclasspathMatch0.12

gnuclasspathMatch0.13

gnuclasspathMatch0.14

gnuclasspathMatch0.15

gnuclasspathMatch0.16

gnuclasspathMatch0.17

gnuclasspathMatch0.18

gnuclasspathMatch0.19

gnuclasspathMatch0.20

gnuclasspathMatch0.90

gnuclasspathMatch0.91

gnuclasspathMatch0.92

gnuclasspathMatch0.93

gnuclasspathMatch0.95

gnuclasspathMatch0.96

gnuclasspathMatch0.96.1

gnuclasspathMatch0.97

gnuclasspathMatch0.97.1

CPENameOperatorVersion
gnu:classpathgnu classpathle0.97.2
gnu:classpathgnu classpatheq0.6
gnu:classpathgnu classpatheq0.7
gnu:classpathgnu classpatheq0.8
gnu:classpathgnu classpatheq0.9
gnu:classpathgnu classpatheq0.10
gnu:classpathgnu classpatheq0.11
gnu:classpathgnu classpatheq0.12
gnu:classpathgnu classpatheq0.13
gnu:classpathgnu classpatheq0.14

CPE	Name	Operator	Version
gnu:classpath	gnu classpath	le	0.97.2
gnu:classpath	gnu classpath	eq	0.6
gnu:classpath	gnu classpath	eq	0.7
gnu:classpath	gnu classpath	eq	0.8
gnu:classpath	gnu classpath	eq	0.9
gnu:classpath	gnu classpath	eq	0.10
gnu:classpath	gnu classpath	eq	0.11
gnu:classpath	gnu classpath	eq	0.12
gnu:classpath	gnu classpath	eq	0.13
gnu:classpath	gnu classpath	eq	0.14

Rows per page:

1-10 of 251

References

gcc.gnu.org/bugzilla/show_bug.cgi?id=38417

www.openwall.com/lists/oss-security/2008/12/06/2

exchange.xforce.ibmcloud.com/vulnerabilities/47574

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

6.4 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.0%

JSON

Related for CVE-2008-5659

ubuntucve1 prion1 cvelist1 nvd1