Vulnerability Details : CVE-2008-5162
The arc4random function in the kernel in FreeBSD 6.3 through 7.1 does not have a proper entropy source for a short time period immediately after boot, which makes it easier for attackers to predict the function's return values and conduct certain attacks against the GEOM framework and various network protocols, related to the Yarrow random number generator.
Exploit prediction scoring system (EPSS) score for CVE-2008-5162
Probability of exploitation activity in the next 30 days: 0.06%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 24 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2008-5162
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.9
|
MEDIUM | AV:L/AC:M/Au:N/C:C/I:C/A:C |
3.4
|
10.0
|
NIST |
7.0
|
HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.0
|
5.9
|
NIST |
CWE ids for CVE-2008-5162
-
Assigned by: nvd@nist.gov (Primary)
-
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.Assigned by: nvd@nist.gov (Primary)
-
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.Assigned by: nvd@nist.gov (Primary)
References for CVE-2008-5162
-
http://www.securityfocus.com/bid/32447
Broken Link;Third Party Advisory;VDB Entry
-
http://security.freebsd.org/advisories/FreeBSD-SA-08:11.arc4random.asc
Vendor Advisory
-
http://securitytracker.com/id?1021276
Broken Link;Third Party Advisory;VDB Entry
-
http://osvdb.org/50137
Broken Link
-
http://secunia.com/advisories/32871
About Secunia Research | FlexeraBroken Link
Products affected by CVE-2008-5162
- cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:6.3:p1:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:6.3:p3:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:6.3:p4:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:6.3:p5:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:6.3:-:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:6.3:p2:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.0:-:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:rc1:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.0:p1:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.0:p3:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.0:p4:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.0:p5:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:-:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p1:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p10:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p12:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p13:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p14:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p15:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p16:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p2:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p3:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p4:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p5:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p6:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p7:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p8:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:p9:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:rc2:*:*:*:*:*:*