GNU Classpath 'gnu.java.security.util.PRNG' Class Entropy Weakness
BID:32909
Info
GNU Classpath 'gnu.java.security.util.PRNG' Class Entropy Weakness
| Bugtraq ID: | 32909 |
| Class: | Design Error |
| CVE: |
CVE-2008-5659 |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 05 2008 12:00AM |
| Updated: | Dec 29 2008 08:51PM |
| Credit: | Jack Lloyd |
| Vulnerable: |
GNU Classpath 0.97.2 |
| Not Vulnerable: | |
Discussion
GNU Classpath 'gnu.java.security.util.PRNG' Class Entropy Weakness
GNU Classpath is prone to a weakness that may result in weaker cryptographic security because its psuedo-random number generator (PRNG) lacks entropy.
Attackers may leverage this issue to obtain sensitive information that can lead to further attacks.
Classpath 0.97.2 is vulnerable; other versions may also be affected.
GNU Classpath is prone to a weakness that may result in weaker cryptographic security because its psuedo-random number generator (PRNG) lacks entropy.
Attackers may leverage this issue to obtain sensitive information that can lead to further attacks.
Classpath 0.97.2 is vulnerable; other versions may also be affected.
Exploit / POC
GNU Classpath 'gnu.java.security.util.PRNG' Class Entropy Weakness
The following proof-of-concept code is available:
The following proof-of-concept code is available:
Solution / Fix
GNU Classpath 'gnu.java.security.util.PRNG' Class Entropy Weakness
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
GNU Classpath 'gnu.java.security.util.PRNG' Class Entropy Weakness
References:
References: