CVE-2008-5659 The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force...
HighCVSS 7.5
EPSS 3.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU classpath | <= 0.97.2 | No fix listed |
| GNU classpath | = 0.6 | No fix listed |
| GNU classpath | = 0.7 | No fix listed |
| GNU classpath | = 0.8 | No fix listed |
| GNU classpath | = 0.9 | No fix listed |
| GNU classpath | = 0.10 | No fix listed |
| GNU classpath | = 0.11 | No fix listed |
| GNU classpath | = 0.12 | No fix listed |
| GNU classpath | = 0.13 | No fix listed |
| GNU classpath | = 0.14 | No fix listed |
| GNU classpath | = 0.15 | No fix listed |
| GNU classpath | = 0.16 | No fix listed |
| GNU classpath | = 0.17 | No fix listed |
| GNU classpath | = 0.18 | No fix listed |
| GNU classpath | = 0.19 | No fix listed |
| GNU classpath | = 0.20 | No fix listed |
| GNU classpath | = 0.90 | No fix listed |
| GNU classpath | = 0.91 | No fix listed |
| GNU classpath | = 0.92 | No fix listed |
| GNU classpath | = 0.93 | No fix listed |
| GNU classpath | = 0.95 | No fix listed |
| GNU classpath | = 0.96 | No fix listed |
| GNU classpath | = 0.96.1 | No fix listed |
| GNU classpath | = 0.97 | No fix listed |
| GNU classpath | = 0.97.1 | No fix listed |