Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2009-3238 | First vendor Publication | 2009-09-18 |
| Vendor | Cve | Last vendor Modification | 2024-02-15 |
Security-Database Scoring CVSS v3
| Cvss vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | |||
|---|---|---|---|
| Overall CVSS Score | 5.5 | ||
| Base Score | 5.5 | Environmental Score | 5.5 |
| impact SubScore | 3.6 | Temporal Score | 5.5 |
| Exploitabality Sub Score | 1.8 | ||
| Attack Vector | Local | Attack Complexity | Low |
| Privileges Required | Low | User Interaction | None |
| Scope | Unchanged | Confidentiality Impact | High |
| Integrity Impact | None | Availability Impact | None |
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 7.8 | Attack Range | Network |
| Cvss Impact Score | 6.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time." |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3238 |
CAPEC : Common Attack Pattern Enumeration & Classification
| Id | Name |
|---|---|
| CAPEC-59 | Session Credential Falsification through Prediction |
| CAPEC-112 | Brute Force |
| CAPEC-281 | Analytic Attacks |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-338 | Use of Cryptographically Weak PRNG |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:28617 | |||
| Oval ID: | oval:org.mitre.oval:def:28617 | ||
| Title: | RHSA-2009:1106 -- kernel security and bug fix update (Important) | ||
| Description: | Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2009:1106 CESA-2009:1106-CentOS 5 CVE-2009-1072 CVE-2009-1192 CVE-2009-1439 CVE-2009-1630 CVE-2009-1633 CVE-2009-1758 CVE-2009-3238 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | kernel |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-02-19 | Name : SuSE Update for kernel SUSE-SA:2010:012 File : nvt/gb_suse_2010_012.nasl |
| 2009-11-17 | Name : SLES10: Security update for Linux kernel File : nvt/sles10_kernel9.nasl |
| 2009-11-11 | Name : Debian Security Advisory DSA 1927-1 (linux-2.6) File : nvt/deb_1927_1.nasl |
| 2009-11-11 | Name : Debian Security Advisory DSA 1928-1 (linux-2.6.24) File : nvt/deb_1928_1.nasl |
| 2009-11-11 | Name : Debian Security Advisory DSA 1929-1 (linux-2.6) File : nvt/deb_1929_1.nasl |
| 2009-09-21 | Name : CentOS Security Advisory CESA-2009:1438 (kernel) File : nvt/ovcesa2009_1438.nasl |
| 2009-09-15 | Name : RedHat Security Advisory RHSA-2009:1438 File : nvt/RHSA_2009_1438.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 58234 | Linux Kernel drivers/char/random.c get_random_int Function RNG Weakness |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1106.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1438.nasl - Type : ACT_GATHER_INFO |
| 2012-05-17 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_kernel-6636.nasl - Type : ACT_GATHER_INFO |
| 2012-05-17 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_kernel-6641.nasl - Type : ACT_GATHER_INFO |
| 2010-10-11 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_kernel-6637.nasl - Type : ACT_GATHER_INFO |
| 2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1927.nasl - Type : ACT_GATHER_INFO |
| 2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1928.nasl - Type : ACT_GATHER_INFO |
| 2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1929.nasl - Type : ACT_GATHER_INFO |
| 2010-02-16 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_kernel-100203.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1106.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1438.nasl - Type : ACT_GATHER_INFO |
| 2009-11-11 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_kernel-6632.nasl - Type : ACT_GATHER_INFO |
| 2009-10-22 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-852-1.nasl - Type : ACT_GATHER_INFO |
| 2009-09-16 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1438.nasl - Type : ACT_GATHER_INFO |
| 2009-06-17 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1106.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-02-15 09:28:16 |
|
| 2024-02-02 01:11:38 |
|
| 2024-02-01 12:03:15 |
|
| 2023-11-07 21:47:40 |
|
| 2023-09-05 12:10:54 |
|
| 2023-09-05 01:03:06 |
|
| 2023-09-02 12:11:00 |
|
| 2023-09-02 01:03:08 |
|
| 2023-08-12 12:12:56 |
|
| 2023-08-12 01:03:07 |
|
| 2023-08-11 12:11:01 |
|
| 2023-08-11 01:03:15 |
|
| 2023-08-06 12:10:37 |
|
| 2023-08-06 01:03:08 |
|
| 2023-08-04 12:10:42 |
|
| 2023-08-04 01:03:11 |
|
| 2023-07-14 12:10:39 |
|
| 2023-07-14 01:03:08 |
|
| 2023-03-29 01:12:11 |
|
| 2023-03-28 12:03:14 |
|
| 2022-10-11 12:09:29 |
|
| 2022-10-11 01:02:57 |
|
| 2022-03-11 01:07:56 |
|
| 2021-05-04 12:10:11 |
|
| 2021-04-22 01:10:37 |
|
| 2020-08-08 01:04:34 |
|
| 2020-08-01 12:04:36 |
|
| 2020-07-30 01:04:44 |
|
| 2020-05-23 01:40:52 |
|
| 2020-05-23 00:24:19 |
|
| 2019-01-25 12:02:52 |
|
| 2018-10-30 12:03:03 |
|
| 2018-07-28 09:19:19 |
|
| 2017-09-19 09:23:24 |
|
| 2016-08-05 12:02:13 |
|
| 2016-06-29 00:07:09 |
|
| 2016-06-28 17:49:41 |
|
| 2016-04-26 19:07:12 |
|
| 2014-02-17 10:51:38 |
|
| 2013-05-10 23:57:28 |
|
