CVE-2008-5162

The arc4random function in the kernel in FreeBSD 6.3 through 7.1 does not have a proper entropy source for a short time period immediately after boot, which makes it easier for attackers to predict the function's return values and conduct certain attacks against the GEOM framework and various...

CVE-2008-5162

The CVE-2008-5162 entry concerns FreeBSD kernel arc4random(9) and its entropy source during the first boot minutes. Technical details across connected docs show: affected software is FreeBSD 6.3–7.1 kernels; problem is insufficient entropy immediately after boot, delaying reseeding from Yarrow an...

SuSE Security Update: Kernel Update for SUSE Linux 10.1 (kernel-4193)

This kernel update brings the kernel to the one shipped with SLES 10 Service Pack 1 and also fixes the following security problems: - CVE-2007-2242: The IPv6 protocol allows remote attackers to cause a denial of service via crafted IPv6 type 0 route headers IPV6RTHDRTYPE0 that create network...

Ubuntu 5.04 : libnet-ssleay-perl vulnerability (USN-113-1)

Javier Fernandez-Sanguino Pena discovered that this library used the file /tmp/entropy as a fallback entropy source if a proper source was not set in the environment variable EGDPATH. This can potentially lead to weakened cryptographic operations if an attacker provides a /tmp/entropy file with...

DEBIAN-CVE-2005-0106

SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGDPATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file...

CVE-2003-0094

CVE-2003-0094 affects Mandrake Linux 8.2/9.0 util-linux mcookie. The patch changed the entropy source from /dev/random to /dev/urandom, making mcookie output more predictable and potentially aiding certain attacks. The Nessus advisory notes the patch was removed in these updates, restoring a bett...

unix entropy source can be used for keystroke timing attacks

Another bizarre vulnerability, for your amusement... Several unix systems systems provide a secure entropy source maintained by collecting certain information that is supposed to be practically unpredictable such as interrupt timings, keyboard scancodes or device request times, then running it th...