BID:32447

FreeBSD 'arc4random (9)' Pseudo-Random Number Generator Insufficient Entropy Weakness

Info

FreeBSD 'arc4random (9)' Pseudo-Random Number Generator Insufficient Entropy Weakness

Bugtraq ID:	32447
Class:	Unknown
CVE:	CVE-2008-5162
Remote:	No
Local:	Yes
Published:	Nov 24 2008 12:00AM
Updated:	Nov 25 2008 09:51PM
Credit:	Robert Woolley, Mark Murray, Maxim Dounin, Ruslan Ermilov
Vulnerable:	FreeBSD FreeBSD 7.1 -RELEASE-p1 FreeBSD FreeBSD 7.1 -PRE-RELEASE FreeBSD FreeBSD 7.0-STABLE FreeBSD FreeBSD 7.0-RELEASE FreeBSD FreeBSD 7.0 -RELENG FreeBSD FreeBSD 7.0 FreeBSD FreeBSD 6.4 -STABLE FreeBSD FreeBSD 6.4 -RELEASE FreeBSD FreeBSD 6.3 -RELENG FreeBSD FreeBSD 6.3 -RELEASE-p6 FreeBSD FreeBSD 6.3

Not Vulnerable:

Discussion

FreeBSD 'arc4random (9)' Pseudo-Random Number Generator Insufficient Entropy Weakness

The FreeBSD kernel is prone to a weakness that may result in weaker cryptographic security.

This issue stems from a lack of sufficient entropy in the 'arc4random (9)' pseudo-random number generator.

An attacker may be able to exploit this weakness to launch attacks against additional applications that depend on the affected pseudo-random number generator.

This issue occurs in FreeBSD 6.3 and 7.0.

Exploit / POC

FreeBSD 'arc4random (9)' Pseudo-Random Number Generator Insufficient Entropy Weakness

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

FreeBSD 'arc4random (9)' Pseudo-Random Number Generator Insufficient Entropy Weakness

Solution:
The vendor has released updates. Please see the references for more information.

FreeBSD FreeBSD 6.4 -STABLE