NVD

Id
42094  
Name
CVE-2013-7372  
Description
The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNG_SecureRandomImpl.java in the SecureRandom implementation in Apache Harmony through 6.0M3, as used in the Java Cryptography Architecture (JCA) in Android before 4.4 and other products, when no seed is provided by the user, uses an incorrect offset value, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging the resulting PRNG predictability, as exploited in the wild against Bitcoin wallet applications in August 2013.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-18  
Published
2014-04-29  
Modified Date
2014-04-30  
Seq
2013-7372  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
212428 42094 CVE-2013-7372 http://android-developers.blogspot.com.au/2013/08/some-securerandom-thoughts.html  View
212429 42094 CVE-2013-7372 http://www.nds.rub.de/media/nds/veroeffentlichungen/2013/03/25/paper_2.pdf  View
212430 42094 CVE-2013-7372 https://android.googlesource.com/platform/libcore/+/kitkat-release/luni/src/main/java/org/apache/harmony/security/provider/crypto/SHA1PRNG_SecureRandomImpl.java  View
212431 42094 CVE-2013-7372 https://bitcoin.org/en/alert/2013-08-11-android  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
24809 JVNDB-2013-006384 Android の Java Cryptography Architecture で使用される Apache Harmony における暗号保護メカニズムを破られる脆弱性 Android の Java Cryptography Architecture (JCA) で使用される Apache Harmony の SecureRandom の実装内の classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNG_SecureRandomImpl.java の engineNextBytes 関数は、ユーザにより提供されたシードがない場合、不正なオフセット値を使用するため、暗号保護メカニズムを破られる脆弱性が存在します。 CVE-2013-7372 67314 CVE-2013-7372 42094 5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-006384.html 2013-08-14 2014-05-02 View