CVE-2005-0106 - SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is no

CVE-2005-0106

Summary

SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGD_PATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file.

References

http://secunia.com/advisories/18639
http://www.mandriva.com/security/advisories?name=MDKSA-2006:023
http://www.securityfocus.com/bid/13471
https://usn.ubuntu.com/113-1/

Vulnerable Configurations

cpe:2.3:o:ubuntu:ubuntu_linux:5.04:*:*:*:*:*:*:*
cpe:2.3:o:ubuntu:ubuntu_linux:5.04:*:*:*:*:*:*:*

CVSS

Base:	4.6 (as of 03-10-2018 - 21:29)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:L/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	13471
mandriva	MDKSA-2006:023
secunia	18639
ubuntu	USN-113-1

Last major update

03-10-2018 - 21:29

Published

03-05-2005 - 04:00

Last modified

03-10-2018 - 21:29