Weak Net::SSLeay perl module encryption

/tmp/entropy file is used for entropy gathering if no entropy source is specified with EGDPATH envoronment variable. Attacker can fille file with known data...

Ubuntu 5.04 : libnet-ssleay-perl vulnerability (USN-113-1)

Javier Fernandez-Sanguino Pena discovered that this library used the file /tmp/entropy as a fallback entropy source if a proper source was not set in the environment variable EGDPATH. This can potentially lead to weakened cryptographic operations if an attacker provides a /tmp/entropy file with...

CVE-2005-3505

CVE-2005-3505 describes a cross-site scripting (XSS) flaw in the Entropy Chat script used by cPanel versions 10.2.0-R82 and 10.6.0-R137. The underlying issue is that a chat message containing JavaScript in style attributes within tags such as can be processed by Internet Explorer, enabling remot...

Secunia Research: cPanel Entropy Chat Script Insertion Vulnerability

====================================================================== Secunia Research 04/11/2005 - cPanel Entropy Chat Script Insertion Vulnerability - ====================================================================== Table of Contents Affected...

EGD detection

A random number generator is listening on the remote port. Description : The Entropy Gathering Daemon is running on the remote host. EGD is a user space random generator for operating systems that lack /dev/random SPDX-FileCopyrightText: 2005 Michel Arboi Some text descriptions might be excerpted...

USN-113-1: libnet-ssleay-perl vulnerability

Javier Fernandez-Sanguino Pena discovered that this library used the file /tmp/entropy as a fallback entropy source if a proper source was not set in the environment variable EGDPATH. This can potentially lead to weakened cryptographic operations if an attacker provides a /tmp/entropy file with...

DEBIAN-CVE-2005-0106

SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGDPATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file...

CVE-2005-0106

SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGDPATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file...

CVE-2005-0106

SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGDPATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file...

CVE-2005-0106

SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGDPATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file...

CVE-2005-0106

CVE-2005-0106 affects the perl module libnet-ssleay-perl (SSLeay.pm) before 1.25. When no entropy source is set in EGD_PATH, it falls back to the file /tmp/entropy, which an attacker with write access to that file could modify to weaken cryptographic operations. Consequence: potential partial imp...

CVE-2005-0106

SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGDPATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file...

CVE-2003-0094

CVE-2003-0094 affects Mandrake Linux 8.2/9.0 util-linux mcookie. The patch changed the entropy source from /dev/random to /dev/urandom, making mcookie output more predictable and potentially aiding certain attacks. The Nessus advisory notes the patch was removed in these updates, restoring a bett...

Mandrake Linux Security Advisory : util-linux (MDKSA-2003:016)

The util-linux package provides the mcookie utility, a tool for generating random cookies that can be used for X authentication. The util-linux packages that were distributed with Mandrake Linux 8.2 and 9.0 had a patch that made it use /dev/urandom instead of /dev/random, which resulted in the...

Entropy sources information leakage

Entropy sources can be used for keystrokes timing attack...

unix entropy source can be used for keystroke timing attacks

Another bizarre vulnerability, for your amusement... Several unix systems systems provide a secure entropy source maintained by collecting certain information that is supposed to be practically unpredictable such as interrupt timings, keyboard scancodes or device request times, then running it th...

CVE-2003-0094

A patch for mcookie in the util-linux package for Mandrake Linux 8.2 and 9.0 uses /dev/urandom instead of /dev/random, which causes mcookie to use an entropy source that is more predictable than expected, which may make it easier for certain types of attacks to succeed...

PT-2001-2103 · Valicert · Valicert Enterprise Validation Authority (Eva) Administration Server

Name of the Vulnerable Software and Affected Versions: ValiCert Enterprise Validation Authority EVA Administration Server versions 3.3 through 4.2.1 Description: The issue arises from the use of insufficiently random data. This affects two main areas: 1 the generation of session tokens for HSMs,...