CVE-2008-0166
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
5
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
OpenSSL versión 0.9.8c-1 hasta versiones anteriores a 0.9.8g-9, sobre sistemas operativos basados en Debian usa un generador de números aleatorios que genera números predecibles, lo que facilita a atacantes remotos la conducción de ataques de adivinación por fuerza bruta contra claves criptográficas.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2008-01-09 CVE Reserved
- 2008-05-13 CVE Published
- 2022-12-07 First Exploit
- 2024-08-07 CVE Updated
- 2024-10-15 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CAPEC
References (27)
| URL | Tag | Source |
|---|---|---|
| http://metasploit.com/users/hdm/tools/debian-openssl | Broken Link | |
| http://sourceforge.net/mailarchive/forum.php?thread_name=48367252.7070603%40shemesh.biz&forum_name=rsyncrypto-devel | Mailing List | |
| http://www.kb.cert.org/vuls/id/925211 | Third Party Advisory |
|
| http://www.securityfocus.com/archive/1/492112/100/0/threaded | Broken Link | |
| http://www.securitytracker.com/id?1020017 | Broken Link | |
| http://www.us-cert.gov/cas/techalerts/TA08-137A.html | Broken Link | |
| https://16years.secvuln.info | ||
| https://exchange.xforce.ibmcloud.com/vulnerabilities/42375 | Third Party Advisory | |
| https://news.ycombinator.com/item?id=40333169 |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/5622 | 2024-08-07 | |
| https://www.exploit-db.com/exploits/5720 | 2024-08-07 | |
| https://www.exploit-db.com/exploits/5632 | 2024-08-07 | |
| https://github.com/demining/Vulnerable-to-Debian-OpenSSL-bug-CVE-2008-0166 | 2022-12-07 | |
| http://www.securityfocus.com/bid/29179 | 2024-08-07 |
| URL | Date | SRC |
|---|---|---|
| http://www.debian.org/security/2008/dsa-1571 | 2024-05-14 | |
| http://www.debian.org/security/2008/dsa-1576 | 2024-05-14 | |
| http://www.ubuntu.com/usn/usn-612-1 | 2024-05-14 | |
| http://www.ubuntu.com/usn/usn-612-2 | 2024-05-14 |
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/30136 | 2024-05-14 | |
| http://secunia.com/advisories/30220 | 2024-05-14 | |
| http://secunia.com/advisories/30221 | 2024-05-14 | |
| http://secunia.com/advisories/30231 | 2024-05-14 | |
| http://secunia.com/advisories/30239 | 2024-05-14 | |
| http://secunia.com/advisories/30249 | 2024-05-14 | |
| http://www.ubuntu.com/usn/usn-612-3 | 2024-05-14 | |
| http://www.ubuntu.com/usn/usn-612-4 | 2024-05-14 | |
| http://www.ubuntu.com/usn/usn-612-7 | 2024-05-14 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | >= 0.9.8c-1 <= 0.9.8g Search vendor "Openssl" for product "Openssl" and version " >= 0.9.8c-1 <= 0.9.8g" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 6.06 Search vendor "Canonical" for product "Ubuntu Linux" and version "6.06" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 7.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "7.04" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 7.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "7.10" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 8.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "8.04" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | - |
Affected
| ||||||