1. CVE-Search
  2. CVE-2007-5502
ID CVE-2007-5502
Summary The PRNG implementation for the OpenSSL FIPS Object Module 1.1.1 does not perform auto-seeding during the FIPS self-test, which generates random data that is more predictable than expected and makes it easier for attackers to bypass protection mechanisms that rely on the randomness.
References
Vulnerable Configurations
  • cpe:2.3:a:openssl:fips_object_module:1.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:fips_object_module:1.1.1:*:*:*:*:*:*:*
CVSS
Base: 6.4 (as of 29-07-2017 - 01:33)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:N
refmap via4
bid 26652
cert-vn VU#150249
confirm http://www.openssl.org/news/secadv_20071129.txt
sectrack 1019029
secunia 27859
vupen ADV-2007-4044
xf openssl-fips-prng-security-bypass(38796)
statements via4
contributor Mark J Cox
lastmodified 2007-12-03
organization Red Hat
statement Not vulnerable. This vulnerability only affected the OpenSSL FIPS Object Module which is not enabled or used by OpenSSL in Red Hat Enterprise Linux 2.1, 3, 4, or 5.
Last major update 29-07-2017 - 01:33
Published 01-12-2007 - 06:46
Last modified 29-07-2017 - 01:33
Back to Top