Description
A certain pseudo-random number generator (PRNG) algorithm that uses ADD with 0 random hops (aka "Algorithm A0"), as used in OpenBSD 3.5 through 4.2 and NetBSD 1.6.2 through 4.0, allows remote attackers to guess sensitive values such as (1) DNS transaction IDs or (2) IP fragmentation IDs by observing a sequence of previously generated values. NOTE: this issue can be leveraged for attacks such as DNS cache poisoning, injection into TCP packets, and OS fingerprinting.
No analysis available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2008-1157 | A certain pseudo-random number generator (PRNG) algorithm that uses ADD with 0 random hops (aka "Algorithm A0"), as used in OpenBSD 3.5 through 4.2 and NetBSD 1.6.2 through 4.0, allows remote attackers to guess sensitive values such as (1) DNS transaction IDs or (2) IP fragmentation IDs by observing a sequence of previously generated values. NOTE: this issue can be leveraged for attacks such as DNS cache poisoning, injection into TCP packets, and OS fingerprinting. |
References
History
No history.
Subscriptions
Apple
Subscribe
Mac Os X
Subscribe
Mac Os X Server
Subscribe
Cosmicperl
Subscribe
Directory Pro
Subscribe
Darwin
Subscribe
Darwin
Subscribe
Dragonflybsd
Subscribe
Dragonflybsd
Subscribe
Freebsd
Subscribe
Freebsd
Subscribe
Navision
Subscribe
Financials Server
Subscribe
Netbsd
Subscribe
Netbsd
Subscribe
Openbsd
Subscribe
Openbsd
Subscribe
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2024-08-07T08:08:57.600Z
Reserved: 2008-03-04T00:00:00.000Z
Link: CVE-2008-1148
No data.
Status : Deferred
Published: 2008-03-04T23:44:00.000
Modified: 2025-04-09T00:30:58.490
Link: CVE-2008-1148
No data.
OpenCVE Enrichment
No data.
Weaknesses
EUVD