252 matches found
PT-2017-6668 · Nts +3 · Ntp +3
Name of the Vulnerable Software and Affected Versions: ntp versions 4.2.8px through 4.2.8p2-RC2 ntp versions 4.3.x through 4.3.12 Description: The issue is related to the generation of MD5 keys with insufficient entropy on big endian machines under specific conditions. This might allow remote...
F5 Networks BIG-IP : Hosts may generate weak RSA keys under low entropy conditions (SOL13607)
A recent study, linked in the Supplemental Information section, has revealed that when a system generates new RSA keys under low-entropy conditions, such as during the first system boot, the resulting keys may not be cryptographically strong. C Tenable Network Security, Inc. The descriptive text...
PT-2014-1003
Name of the Vulnerable Software and Affected Versions Siemens SIMATIC S7-1200 CPU PLC devices with firmware prior to 4.0 Description The issue concerns a problem with the random-number generator in the authentication handler of the web server, which lacks sufficient entropy. This makes it easier...
[Haveged 1.9.1] A simple entropy daemon
The haveged project is an attempt to provide an easy-to-use, unpredictable random number generator based upon an adaptation of the HAVEGE algorithm. Haveged was created to remedy low-entropy conditions in the Linux random device that can occur under some workloads, especially on headless servers...
[Haveged] A simple Entropy Daemon
The haveged project is an attempt to provide an easy-to-use, unpredictable random number generator based upon an adaptation of the HAVEGE algorithm. Haveged was created to remedy low-entropy conditions in the Linux random device that can occur under some workloads, especially on headless servers...
CVE-2012-3039: Undefined Security Weakness
Moxa OnCell Gateway G3111, G3151, G3211, and G3251 devices with firmware before 1.4 do not use a sufficient source of entropy for SSH and SSL keys, which makes it easier for remote attackers to obtain access by leveraging knowledge of a key from a product installation elsewhere...
CVE-2012-2742: Undefined Security Weakness
Revelation 0.4.13-2 and earlier uses only the first 32 characters of a password followed by a sequence of zeros, which reduces the entropy and makes it easier for context-dependent attackers to crack passwords and obtain access to keys via a brute-force attack...
SOL13607 - Hosts may generate weak RSA keys under low entropy conditions
A recent study, linked in the Supplemental Information section, has revealed that when a system generates new RSA keys under low-entropy conditions, such as during the first system boot, the resulting keys may not be cryptographically strong. During its first boot, the BIG-IP system generates...
DEBIAN-CVE-2008-7278
The S/MIME feature in Open Ticket Request System OTRS before 2.2.5, and 2.3.x before 2.3.0-beta1, does not properly configure the RANDFILE environment variable for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available fo...
RHEL 6 : krb5 (RHSA-2010:0925)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0925 advisory. Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a...
krb5: krb5 may accept authdata checksums with low-entropy derived keys (MITKRB5-SA-2010-007)
MIT Kerberos 5 aka krb5 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to forge a 1 AD-SIGNEDPATH or 2 AD-KDC-ISSUED signature, and possibly gain privileges, by leveraging the small key space that results from certain one-byte...