7

CVE-2008-5162

The arc4random function in the kernel in FreeBSD 6.3 through 7.1 does not have a proper entropy source for a short time period immediately after boot, which makes it easier for attackers to predict the function's return values and conduct certain attacks against the GEOM framework and various network protocols, related to the Yarrow random number generator.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Freebsd ≫ Freebsd Version >= 6.4 < 7.0
Freebsd ≫ Freebsd Version 6.3 Update -
Freebsd ≫ Freebsd Version 6.3 Update p1
Freebsd ≫ Freebsd Version 6.3 Update p2
Freebsd ≫ Freebsd Version 6.3 Update p3
Freebsd ≫ Freebsd Version 6.3 Update p4
Freebsd ≫ Freebsd Version 6.3 Update p5
Freebsd ≫ Freebsd Version 7.0 Update -
Freebsd ≫ Freebsd Version 7.0 Update p1
Freebsd ≫ Freebsd Version 7.0 Update p3
Freebsd ≫ Freebsd Version 7.0 Update p4
Freebsd ≫ Freebsd Version 7.0 Update p5
Freebsd ≫ Freebsd Version 7.1 Update -
Freebsd ≫ Freebsd Version 7.1 Update p1
Freebsd ≫ Freebsd Version 7.1 Update p10
Freebsd ≫ Freebsd Version 7.1 Update p12
Freebsd ≫ Freebsd Version 7.1 Update p13
Freebsd ≫ Freebsd Version 7.1 Update p14
Freebsd ≫ Freebsd Version 7.1 Update p15
Freebsd ≫ Freebsd Version 7.1 Update p16
Freebsd ≫ Freebsd Version 7.1 Update p2
Freebsd ≫ Freebsd Version 7.1 Update p3
Freebsd ≫ Freebsd Version 7.1 Update p4
Freebsd ≫ Freebsd Version 7.1 Update p5
Freebsd ≫ Freebsd Version 7.1 Update p6
Freebsd ≫ Freebsd Version 7.1 Update p7
Freebsd ≫ Freebsd Version 7.1 Update p8
Freebsd ≫ Freebsd Version 7.1 Update p9
Freebsd ≫ Freebsd Version 7.1 Update rc1
Freebsd ≫ Freebsd Version 7.1 Update rc2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.32% 0.234
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7 1 5.9
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
CWE-330 Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

http://osvdb.org/50137
Broken Link
http://secunia.com/advisories/32871
Broken Link
http://security.freebsd.org/advisories/FreeBSD-SA-08:11.arc4random.asc
Vendor Advisory
http://securitytracker.com/id?1021276
Third Party Advisory
Broken Link
VDB Entry
http://www.securityfocus.com/bid/32447
Third Party Advisory
Broken Link
VDB Entry