CVE-2008-5659
GNU Classpath 0.97.2 - 'gnu.java.security.util.PRNG' Class Entropy
Severity Score
9.1
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.
La clase gnu.java.security.util.PRNG en GNU Classpath 0.97.2 y versiones anteriores usa una semilla predecible basada en la hora del sistema, la cual hace más fácil para atacantes dependientes de contexto, guiar un ataque de fuerza bruta contra rutinas criptográficas que usa esta clase para la aletoriedad, como se demuestra contra claves privadas DSA.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2008-12-05 First Exploit
- 2008-12-17 CVE Reserved
- 2008-12-17 CVE Published
- 2024-08-07 CVE Updated
- 2024-10-13 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-310: Cryptographic Issues
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://gcc.gnu.org/bugzilla/show_bug.cgi?id=38417 | X_refsource_confirm | |
| http://www.openwall.com/lists/oss-security/2008/12/06/2 | Mailing List |
|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/47574 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/32674 | 2008-12-05 | |
| https://www.exploit-db.com/exploits/32673 | 2008-12-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | <= 0.97.2 Search vendor "Gnu" for product "Classpath" and version " <= 0.97.2" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.6 Search vendor "Gnu" for product "Classpath" and version "0.6" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.7 Search vendor "Gnu" for product "Classpath" and version "0.7" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.8 Search vendor "Gnu" for product "Classpath" and version "0.8" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.9 Search vendor "Gnu" for product "Classpath" and version "0.9" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.10 Search vendor "Gnu" for product "Classpath" and version "0.10" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.11 Search vendor "Gnu" for product "Classpath" and version "0.11" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.12 Search vendor "Gnu" for product "Classpath" and version "0.12" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.13 Search vendor "Gnu" for product "Classpath" and version "0.13" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.14 Search vendor "Gnu" for product "Classpath" and version "0.14" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.15 Search vendor "Gnu" for product "Classpath" and version "0.15" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.16 Search vendor "Gnu" for product "Classpath" and version "0.16" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.17 Search vendor "Gnu" for product "Classpath" and version "0.17" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.18 Search vendor "Gnu" for product "Classpath" and version "0.18" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.19 Search vendor "Gnu" for product "Classpath" and version "0.19" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.20 Search vendor "Gnu" for product "Classpath" and version "0.20" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.90 Search vendor "Gnu" for product "Classpath" and version "0.90" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.91 Search vendor "Gnu" for product "Classpath" and version "0.91" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.92 Search vendor "Gnu" for product "Classpath" and version "0.92" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.93 Search vendor "Gnu" for product "Classpath" and version "0.93" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.95 Search vendor "Gnu" for product "Classpath" and version "0.95" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.96 Search vendor "Gnu" for product "Classpath" and version "0.96" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.96.1 Search vendor "Gnu" for product "Classpath" and version "0.96.1" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.97 Search vendor "Gnu" for product "Classpath" and version "0.97" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Classpath Search vendor "Gnu" for product "Classpath" | 0.97.1 Search vendor "Gnu" for product "Classpath" and version "0.97.1" | - |
Affected
| ||||||