CVE-2012-2387 devotee 0.1 patch 2 uses a 32-bit seed for generating 48-bit random numbers, which makes it easier for remote attackers to obtain the secret monikers via a brute force attack.
MediumCVSS 5.0
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
devotee 0.1 patch 2 uses a 32-bit seed for generating 48-bit random numbers, which makes it easier for remote attackers to obtain the secret monikers via a brute force attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian devotee | = 0.1 | No fix listed |
References
- [oss-security] 20120518 CVE id request: devotee (debian vote engine) cryptographically weak random numbers permit discovery of secret ballot submissions mailing-list
- [oss-security] 20120521 Re: CVE id request: devotee (debian vote engine) cryptographically weak random numbers permit discovery of secret ballot submissions mailing-list
- [oss-security] 20120522 CVE id request: devotee (debian vote engine) cryptographically weak random numbers permit discovery of secret ballot submissions mailing-list