A certain pseudo-random number generator (PRNG) algorithm that uses XOR...
Vulnerability Description
A certain pseudo-random number generator (PRNG) algorithm that uses XOR and 3-bit random hops (aka "Algorithm X3"), as used in OpenBSD 2.8 through 4.2, allows remote attackers to guess sensitive values such as DNS transaction IDs by observing a sequence of previously generated values. NOTE: this issue can be leveraged for attacks such as DNS cache poisoning against OpenBSD's modification of BIND.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2008-1146
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.securityfocus.com/archive/1/487658
- http://secunia.com/advisories/28819
- http://www.trusteer.com/docs/OpenBSD_DNS_Cache_Poisoning_and_Multiple_OS_Predictable_IP_ID_Vulnerability.pdf
- http://www.securiteam.com/securityreviews/5PP0H0UNGW.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/40329
- http://www.securityfocus.com/bid/27647
More from cosmicperl
View All →Affected Vendor
cosmicperl
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.