FreeBSD arc4random (9)伪随机数生成器不充分漏洞

BUGTRAQ ID: 32447 CVECAN ID: CVE-2008-5162 FreeBSD就是一种运行在Intel平台上、可以自由使用的开放源码Unix类系统。 FreeBSD内核中广泛使用arc4random9随机数生成器，一些应用依赖于该随机数生成器的加密强度。arc4random9定期用来自FreeBSD内核的Yarrow随机数生成器的熵重新提供种子，Yarrow随机数生成器从包括硬件中断等各种来源收集熵。在引导阶段，从用户域向Yarrow随机数生成器提供了额外的，以确保加密中有足够的熵。...

FreeBSD-SA-08:11.arc4random

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-08.11.arc4random Security Advisory The FreeBSD Project Topic: arc4random9 predictable sequence vulnerability Category: core Module: sys Announced: 2008-11-24...

FreeBSD -- arc4random(9) predictable sequence vulnerability

Problem Description: When the arc4random9 random number generator is initialized, there may be inadequate entropy to meet the needs of kernel systems which rely on arc4random9; and it may take up to 5 minutes before arc4random9 is reseeded with secure entropy from the Yarrow random number...

Design/Logic Flaw

The highlighting functionality in geshi.php in GeSHi before 1.0.8 allows remote attackers to cause a denial of service infinite loop via an XML sequence containing an opening delimiter without a closing delimiter, as demonstrated using ""...

CVE-2008-5185

The highlighting functionality in geshi.php in GeSHi before 1.0.8 allows remote attackers to cause a denial of service infinite loop via an XML sequence containing an opening delimiter without a closing delimiter, as demonstrated using ""...

CVE-2008-5185

The highlighting functionality in geshi.php in GeSHi before 1.0.8 allows remote attackers to cause a denial of service infinite loop via an XML sequence containing an opening delimiter without a closing delimiter, as demonstrated using ""...

CVE-2008-5185: Undefined Security Weakness

The highlighting functionality in geshi.php in GeSHi before 1.0.8 allows remote attackers to cause a denial of service infinite loop via an XML sequence containing an opening delimiter without a closing delimiter, as demonstrated using ""...

DEBIAN-CVE-2008-4306

Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence...

CVE-2008-4306

Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence...

Buffer overflow

Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence...

CVE-2008-4306

Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence...

CVE-2008-4306: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence...

DEBIAN-CVE-2008-4326

The PMAescapeJsString function in libraries/jsescape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via a NUL byte inside a "/script" sequence...

DATAC RealWin 2.0 SCADA Software - Remote PreaAuth Exploit

Hi --------------------------------- http://www.dataconline.com/software/realwin.php "RealWin is a SCADA server product which includes a FlexView HMI and runs on current Microsoft Windows platforms 2000 and XP. It can operate on a single PC or multiple PCs connected through a TCP/IP network. It...

CVE-2008-3612

The Networking subsystem in Apple iPod touch 2.0 through 2.0.2, and iPhone 2.0 through 2.0.2, uses predictable TCP initial sequence numbers, which allows remote attackers to spoof or hijack a TCP connection...

Design/Logic Flaw

The Networking subsystem in Apple iPod touch 2.0 through 2.0.2, and iPhone 2.0 through 2.0.2, uses predictable TCP initial sequence numbers, which allows remote attackers to spoof or hijack a TCP connection...

CVE-2008-3612

The CVE-2008-3612 entry affects Apple iPod touch 2.0–2.0.2 and iPhone 2.0–2.0.2, where the Networking subsystem uses predictable TCP initial sequence numbers. This design allows remote attackers to spoof or hijack TCP connections. Documented impact includes potential spoofing and session hijackin...

PT-2008-4988 · Apple · Iphone +1

Name of the Vulnerable Software and Affected Versions: Apple iPod touch versions 2.0 through 2.0.2 Apple iPhone versions 2.0 through 2.0.2 Description: The issue is related to the Networking subsystem, which uses predictable TCP initial sequence numbers. This allows remote attackers to potentiall...

FreeBSD Security Advisory (FreeBSD-SA-05:15.tcp.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-05:15.tcp.asc ADV FreeBSD-SA-05:15.tcp.asc OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Security Advisory (FreeBSD-SA-06:11.ipsec.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-06:11.ipsec.asc ADV FreeBSD-SA-06:11.ipsec.asc OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft...