NVD

Id
28971  
Name
CVE-2014-0017  
Description
The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision.  
Reject
 
CVSS Version
2  
CVSS Score
1.9  
Severity
Low  
CVSS Base Score
1.9  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2014-03-14  
Modified Date
2014-03-26  
Seq
2014-0017  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
152727 28971 CVE-2014-0017 openSUSE-SU-2014:0366  View
152728 28971 CVE-2014-0017 openSUSE-SU-2014:0370  View
152729 28971 CVE-2014-0017 DSA-2879  View
152730 28971 CVE-2014-0017 http://www.libssh.org/2014/03/04/libssh-0-6-3-security-release/  View
152731 28971 CVE-2014-0017 [oss-security] 20140305 libssh and stunnel PRNG flaws  View
152732 28971 CVE-2014-0017 USN-2145-1  View
152733 28971 CVE-2014-0017 https://bugzilla.redhat.com/show_bug.cgi?id=1072191  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
12824 JVNDB-2014-001699 libssh の RAND_bytes 関数における重要な情報を取得される脆弱性 libssh の RAND_bytes 関数は、フォーキング (forking) が有効になっている場合、OpenSSL の擬似乱数生成器 (PRNG) の状態を適切にリセットしないため、子プロセス間で状態が共有され、重要な情報を取得される脆弱性が存在します。 CVE-2014-0017 67418 CVE-2014-0017 28971 1.9 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-001699.html 2014-03-04 2014-03-28 View