7.5high
CVE-2008-0166in critical feed3 exploits
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable…
Published 18 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
70.7%
percentile 99%
Public exploits
3
Exploit-DB
Summary
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
Exploit prediction (EPSS)
70.72% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.
Exploits and detections
- EDB-5720 OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH · remote · 2008-06-01
- EDB-5632 OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH (Ruby) · remote · 2008-05-16
- EDB-5622 OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH · remote · 2008-05-15
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 7.8 | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Classification
- Weakness
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
- Technology feeds
- OpenSSL (RSS, critical only)
References
- debian.org /security/2008/dsa-1576 · vendor-advisory, x_transferred
- exploit-db.com /exploits/5622 · exploit, x_transferred
- secunia.com /advisories/30221 · third-party-advisory, x_transferred
- sourceforge.net /mailarchive/forum.php?thread_name=48367252.7070603%40shemesh.biz&forum_name=rsyncrypto-de · mailing-list, x_transferred
- debian.org /security/2008/dsa-1571 · vendor-advisory, x_transferred
- securityfocus.com /bid/29179 · vdb-entry, x_transferred
- securityfocus.com /archive/1/492112/100/0/threaded · mailing-list, x_transferred
- secunia.com /advisories/30239 · third-party-advisory, x_transferred
- secunia.com /advisories/30220 · third-party-advisory, x_transferred
- ubuntu.com /usn/usn-612-7 · vendor-advisory, x_transferred
- secunia.com /advisories/30231 · third-party-advisory, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/42375 · vdb-entry, x_transferred
- metasploit.com /users/hdm/tools/debian-openssl/ · x_transferred
- secunia.com /advisories/30249 · third-party-advisory, x_transferred
- securitytracker.com /id?1020017 · vdb-entry, x_transferred
- exploit-db.com /exploits/5632 · exploit, x_transferred
- ubuntu.com /usn/usn-612-4 · vendor-advisory, x_transferred
- ubuntu.com /usn/usn-612-2 · vendor-advisory, x_transferred
- us-cert.gov /cas/techalerts/TA08-137A.html · third-party-advisory, x_transferred
- kb.cert.org /vuls/id/925211 · third-party-advisory, x_transferred
- exploit-db.com /exploits/5720 · exploit, x_transferred
- secunia.com /advisories/30136 · third-party-advisory, x_transferred
- ubuntu.com /usn/usn-612-3 · vendor-advisory, x_transferred
- ubuntu.com /usn/usn-612-1 · vendor-advisory, x_transferred
- 16years.secvuln.info · x_transferred
- news.ycombinator.com /item?id=40333169 · x_transferred
Sources
- CVE List: CVE-2008-0166
- NVD: CVE-2008-0166
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.