Vulnerability Details : CVE-2008-5162
The arc4random function in the kernel in FreeBSD 6.3 through 7.1 does not have a proper entropy source for a short time period immediately after boot, which makes it easier for attackers to predict the function's return values and conduct certain attacks against the GEOM framework and various network protocols, related to the Yarrow random number generator.
Products affected by CVE-2008-5162
- cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:6.3:p1:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:6.3:p3:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:6.3:p4:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:6.3:p5:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:6.3:-:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:6.3:p2:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.0:-:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:rc1:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.0:p1:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.0:p3:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.0:p4:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.0:p5:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:-:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p1:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p10:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p12:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p13:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p14:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p15:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p16:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p2:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p3:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p4:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p5:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p6:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p7:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p8:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p9:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:rc2:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2008-5162
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 24 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2008-5162
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.9
|
MEDIUM | AV:L/AC:M/Au:N/C:C/I:C/A:C |
3.4
|
10.0
|
NIST | |
|
7.0
|
HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.0
|
5.9
|
NIST | 2024-02-14 |
CWE ids for CVE-2008-5162
-
Assigned by: nvd@nist.gov (Primary)
-
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.Assigned by: nvd@nist.gov (Primary)
-
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.Assigned by: nvd@nist.gov (Primary)
References for CVE-2008-5162
-
http://www.securityfocus.com/bid/32447
Broken Link;Third Party Advisory;VDB Entry
-
http://security.freebsd.org/advisories/FreeBSD-SA-08:11.arc4random.asc
Vendor Advisory
-
http://securitytracker.com/id?1021276
Broken Link;Third Party Advisory;VDB Entry
-
http://osvdb.org/50137
Broken Link
-
http://secunia.com/advisories/32871
About Secunia Research | FlexeraBroken Link
Jump to