Stunnel CVE-2014-0016 PRNG Initialization Weakness

BID:65964

Info

Stunnel CVE-2014-0016 PRNG Initialization Weakness

Bugtraq ID: 65964
Class: Design Error
CVE: CVE-2014-0016
Remote: Yes
Local: No
Published: Mar 04 2014 12:00AM
Updated: Feb 02 2017 06:00AM
Credit: Aris Adamantiadis
Vulnerable: Stunnel Stunnel 4.0 4
Stunnel Stunnel 4.0 3
Stunnel Stunnel 4.0 2
Stunnel Stunnel 4.0 1
Stunnel Stunnel 4.0 0
Stunnel Stunnel 3.26
Stunnel Stunnel 3.25
+ Trustix Secure Linux 1.5
+ Trustix Secure Linux 1.2
Stunnel Stunnel 3.24
Stunnel Stunnel 3.22
+ EnGarde Secure Community 2.0
+ EnGarde Secure Community 1.0.1
+ EnGarde Secure Professional 1.5
+ EnGarde Secure Professional 1.2
+ EnGarde Secure Professional 1.1
+ Sun Linux 5.0.7
Stunnel Stunnel 3.21 c
Stunnel Stunnel 3.21 b
Stunnel Stunnel 3.21 a
Stunnel Stunnel 3.21
Stunnel Stunnel 3.19
+ Redhat Linux 7.2 ia64
+ Redhat Linux 7.2 i386
Stunnel Stunnel 3.18
Stunnel Stunnel 3.17
Stunnel Stunnel 3.16
Stunnel Stunnel 3.15
Stunnel Stunnel 3.14
Stunnel Stunnel 3.13
Stunnel Stunnel 3.12
- Microsoft Windows 2000 Professional
- Microsoft Windows 98
- Sun Solaris 8_sparc
- Sun Solaris 7.0
Stunnel Stunnel 3.11
- Microsoft Windows 2000 Professional
- Microsoft Windows 98
- Sun Solaris 8_sparc
- Sun Solaris 7.0
Stunnel Stunnel 3.9
- Debian Linux 2.3
- Debian Linux 2.2
- Debian Linux 2.1
- Debian Linux 2.0
- FreeBSD FreeBSD 5.0
- FreeBSD FreeBSD 4.2
- FreeBSD FreeBSD 4.1
- FreeBSD FreeBSD 4.0
- OpenBSD OpenBSD 2.8
- OpenBSD OpenBSD 2.7
- OpenBSD OpenBSD 2.6
- OpenBSD OpenBSD 2.5
- OpenBSD OpenBSD 2.4
- OpenBSD OpenBSD 2.3
- OpenBSD OpenBSD 2.1
- OpenBSD OpenBSD 2.0
- Redhat Linux 7.0
- Redhat Linux 6.0 x
- Redhat Linux 5.0
Stunnel Stunnel 3.8
- Debian Linux 2.3
- Debian Linux 2.2
- Debian Linux 2.1
- Debian Linux 2.0
+ EnGarde Secure Linux 1.0.1
- FreeBSD FreeBSD 5.0
- FreeBSD FreeBSD 4.2
- FreeBSD FreeBSD 4.1
- FreeBSD FreeBSD 4.0
- OpenBSD OpenBSD 2.8
- OpenBSD OpenBSD 2.7
- OpenBSD OpenBSD 2.6
- OpenBSD OpenBSD 2.5
- OpenBSD OpenBSD 2.4
- OpenBSD OpenBSD 2.3
- OpenBSD OpenBSD 2.1
- OpenBSD OpenBSD 2.0
- Redhat Linux 7.0
- Redhat Linux 6.0 x
- Redhat Linux 5.0
Stunnel Stunnel 3.7
- Debian Linux 2.3
- Debian Linux 2.2
- Debian Linux 2.1
- Debian Linux 2.0
- FreeBSD FreeBSD 5.0
- FreeBSD FreeBSD 4.2
- FreeBSD FreeBSD 4.1
- FreeBSD FreeBSD 4.0
- OpenBSD OpenBSD 2.8
- OpenBSD OpenBSD 2.7
- OpenBSD OpenBSD 2.6
- OpenBSD OpenBSD 2.5
- OpenBSD OpenBSD 2.4
- OpenBSD OpenBSD 2.3
- OpenBSD OpenBSD 2.1
- OpenBSD OpenBSD 2.0
- Redhat Linux 7.0
- Redhat Linux 6.0 x
- Redhat Linux 5.0
Stunnel Stunnel 3.4 a
- Debian Linux 2.3
- Debian Linux 2.2
- Debian Linux 2.1
- Debian Linux 2.0
- FreeBSD FreeBSD 5.0
- FreeBSD FreeBSD 4.2
- FreeBSD FreeBSD 4.1
- FreeBSD FreeBSD 4.0
- OpenBSD OpenBSD 2.8
- OpenBSD OpenBSD 2.7
- OpenBSD OpenBSD 2.6
- OpenBSD OpenBSD 2.5
- OpenBSD OpenBSD 2.4
- OpenBSD OpenBSD 2.3
- OpenBSD OpenBSD 2.1
- OpenBSD OpenBSD 2.0
- Redhat Linux 7.0
- Redhat Linux 6.0 x
- Redhat Linux 5.0
Stunnel Stunnel 3.3
- Debian Linux 2.3
- Debian Linux 2.2
- Debian Linux 2.1
- Debian Linux 2.0
- FreeBSD FreeBSD 5.0
- FreeBSD FreeBSD 4.2
- FreeBSD FreeBSD 4.1
- FreeBSD FreeBSD 4.0
- OpenBSD OpenBSD 2.8
- OpenBSD OpenBSD 2.7
- OpenBSD OpenBSD 2.6
- OpenBSD OpenBSD 2.5
- OpenBSD OpenBSD 2.4
- OpenBSD OpenBSD 2.3
- OpenBSD OpenBSD 2.1
- OpenBSD OpenBSD 2.0
- Redhat Linux 7.0
- Redhat Linux 6.0 x
- Redhat Linux 5.0
- Trustix Secure Linux 1.2
- Trustix Trustix Secure Linux 1.1
- Trustix Trustix Secure Linux 1.0
Stunnel Stunnel 4.56
- Microsoft Windows 2000 Professional
- Microsoft Windows 98
- Sun Solaris 8_sparc
- Sun Solaris 7.0
Stunnel Stunnel 4.55
Stunnel Stunnel 4.54
Stunnel Stunnel 4.53
Stunnel Stunnel 4.52
Stunnel Stunnel 4.42
Stunnel Stunnel 4.41
Stunnel Stunnel 4.40
Stunnel Stunnel 4.35
Stunnel Stunnel 4.34
Stunnel Stunnel 4.33
Stunnel Stunnel 4.32
Stunnel Stunnel 4.31
Stunnel Stunnel 4.30
Stunnel Stunnel 4.24
Stunnel Stunnel 4.23
Stunnel Stunnel 4.22
Stunnel Stunnel 4.21
Stunnel Stunnel 3.20
+ Mandriva Linux Mandrake 8.1 ia64
+ Mandriva Linux Mandrake 8.1
Stunnel Stunnel 3.10
- Microsoft Windows 2000 Professional
- Microsoft Windows 98
- Sun Solaris 8_sparc
- Sun Solaris 7.0
Stunnel Stunnel 3.0
- Microsoft Windows 2000 Professional
- Microsoft Windows 98
- Sun Solaris 8_sparc
- Sun Solaris 7.0
Stunnel Stunnel 2.0
- Microsoft Windows 2000 Professional
- Microsoft Windows 98
- Sun Solaris 8_sparc
- Sun Solaris 7.0
Oracle Solaris 11.3
Gentoo Linux
Not Vulnerable: Stunnel Stunnel 5.14
Stunnel Stunnel 5.13
Stunnel Stunnel 5.12
Stunnel Stunnel 5.11
Stunnel Stunnel 5.10
Stunnel Stunnel 5.09
Stunnel Stunnel 5.08
Stunnel Stunnel 5.07
Stunnel Stunnel 5.06
Stunnel Stunnel 5.05
Stunnel Stunnel 5.04
Stunnel Stunnel 5.03
Stunnel Stunnel 5.02
Stunnel Stunnel 5.01
Stunnel Stunnel 5.00
Stunnel Stunnel 4.57
- Microsoft Windows 2000 Professional
- Microsoft Windows 98
- Sun Solaris 8_sparc
- Sun Solaris 7.0

Discussion

Stunnel CVE-2014-0016 PRNG Initialization Weakness

Stunnel is prone to a security weakness because it fails to properly Initialization PRNG.

An attacker can exploit this weakness to predict random number values that can aid in further attacks.

Stunnel 2.00 through 4.56 are vulnerable.

Exploit / POC

Stunnel CVE-2014-0016 PRNG Initialization Weakness

An attacker can exploit this issue using readily available tools.

Solution / Fix

Stunnel CVE-2014-0016 PRNG Initialization Weakness

Solution:
Updates are available. Please see the references or vendor advisory for more information.

References

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report