ID

VAR-200803-0323

CVE

CVE-2008-1147

TITLE

OpenBSD Used in PRNG Vulnerabilities whose important values are inferred in allegorism

DESCRIPTION

A certain pseudo-random number generator (PRNG) algorithm that uses XOR and 2-bit random hops (aka "Algorithm X2"), as used in OpenBSD 2.6 through 3.4, Mac OS X 10 through 10.5.1, FreeBSD 4.4 through 7.0, and DragonFlyBSD 1.0 through 1.10.1, allows remote attackers to guess sensitive values such as IP fragmentation IDs by observing a sequence of previously generated values. NOTE: this issue can be leveraged for attacks such as injection into TCP packets and OS fingerprinting. A PRNG originating in OpenBSD is prone to a weakness that exposes DNS cache-poisoning and predictable IP ID sequence issues. This issue stems from a flaw in the linear congruential generator (LCG) pseudo-random number generator (PRNG) algorithm. An attacker may leverage this issue to manipulate DNS cache data, potentially facilitating man-in-the-middle, site-impersonation, or denial-of-service attacks. The attacker may also predict IP ID sequences, allowing them to perform OS fingerprinting, network idle-scanning, and potentially TCP blind data-injection attacks. The BIND 9 server included in OpenBSD 3.3 through to 4.2 is vulnerable to this issue. The vulnerable PRNG algorithm and variants are also used in the IP ID sequence generation in OpenBSD 2.6 through to 4.2. The vulnerable PRNG has also been ported to other operating systems, including: Mac OS X and Mac OS X Server 10.0 through to 10.5.1 Darwin 1.0 through to 9.1 FreeBSD 4.4 through to 7.0 NetBSD 1.6.2 through to 4.0 DragonFlyBSD 1.0 through to 1.10.1. FreeBSD, NetBSD, and DragonFlyBSD are affected only if they enable the PRNG's use through the 'net.inet.ip.random_id' sysctl to 1. This is a nondefault configuration change. Other operating systems and versions may also be affected. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: OpenBSD DNS Server PRNG Transaction ID Vulnerability SECUNIA ADVISORY ID: SA28819 VERIFY ADVISORY: http://secunia.com/advisories/28819/ CRITICAL: Moderately critical IMPACT: Spoofing WHERE: >From remote OPERATING SYSTEM: OpenBSD 3.x http://secunia.com/product/100/ OpenBSD 4.0 http://secunia.com/product/12486/ OpenBSD 4.1 http://secunia.com/product/16044/ OpenBSD 4.2 http://secunia.com/product/16045/ DESCRIPTION: Amit Klein has reported a vulnerability in OpenBSD, which can be exploited by malicious people to poison the DNS cache. The vulnerability is caused due to a weakness within the OpenBSD DNS server's pseudo random number generator (PRNG). This can be exploited to obtain the DNS transaction ID and poison the DNS cache. The vulnerability is reported in OpenBSD versions 3.3 to 4.2. SOLUTION: Do not rely on the information returned by an OpenBSD DNS server. PROVIDED AND/OR DISCOVERED BY: Amit Klein, Trusteer ORIGINAL ADVISORY: http://www.trusteer.com/docs/dnsopenbsd.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

Design Error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Amit Klein discovered this vulnerability.

SOURCES

LAST UPDATE DATE

2024-08-14T13:38:42.242000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE