CVE-2011-0766 The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, which...
HighCVSS 7.8
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, which makes it easier for remote attackers to guess DSA host and SSH session keys.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| erlang crypto | <= 2.0.2.1 | No fix listed |
| erlangotp | = r11b-5 | No fix listed |
| erlangotp | = r12b-5 | No fix listed |
| erlangotp | = r13b | No fix listed |
| erlangotp | = r13b02-1 | No fix listed |
| erlangotp | = r13b03 | No fix listed |
| erlangotp | = r13b04 | No fix listed |
| erlangotp | = r14a | No fix listed |
| erlangotp | = r14b | No fix listed |
| erlangotp | = r14b01 | No fix listed |
| erlangotp | = r14b02 | No fix listed |
| ssh | <= 2.0.4 | No fix listed |
| debian/erlang(Debian:12) | < 1:14.b.3-dfsg-1 | 1:14.b.3-dfsg-1 |
| debian/erlang(Debian:13) | < 1:14.b.3-dfsg-1 | 1:14.b.3-dfsg-1 |
| debian/erlang(Debian:14) | < 1:14.b.3-dfsg-1 | 1:14.b.3-dfsg-1 |
References
- 44709 third-party-advisory vendor-advisory
- VU#178990 patch third-party-advisory us-government-resource
- 47980 third-party-advisory vdb-entry
- github.com patch
- Debian Security Tracker CVE-2011-0766 vendor-advisory
- bugs.debian.org issue-tracking