Executive Summary

Informations
Name CVE-2009-3238 First vendor Publication 2009-09-18
Vendor Cve Last vendor Modification 2018-07-28

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:N/A:N)
Cvss Base Score 7.8 Attack Range Network
Cvss Impact Score 6.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3238

CAPEC : Common Attack Pattern Enumeration & Classification

Id Name
CAPEC-59 Session Credential Falsification through Prediction
CAPEC-112 Brute Force
CAPEC-281 Analytic Attacks

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-310 Cryptographic Issues

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11168
 
Oval ID: oval:org.mitre.oval:def:11168
Title: The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."
Description: The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."
Family: unix Class: vulnerability
Reference(s): CVE-2009-3238
Version: 5
Platform(s): Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22334
 
Oval ID: oval:org.mitre.oval:def:22334
Title: ELSA-2009:1106: kernel security and bug fix update (Important)
Description: The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."
Family: unix Class: patch
Reference(s): ELSA-2009:1106-01
CVE-2009-1072
CVE-2009-1192
CVE-2009-1439
CVE-2009-1630
CVE-2009-1633
CVE-2009-1758
CVE-2009-3238
Version: 33
Platform(s): Oracle Linux 5
Product(s): kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28617
 
Oval ID: oval:org.mitre.oval:def:28617
Title: RHSA-2009:1106 -- kernel security and bug fix update (Important)
Description: Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system.
Family: unix Class: patch
Reference(s): RHSA-2009:1106
CESA-2009:1106-CentOS 5
CVE-2009-1072
CVE-2009-1192
CVE-2009-1439
CVE-2009-1630
CVE-2009-1633
CVE-2009-1758
CVE-2009-3238
Version: 3
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): kernel
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Os 1137

OpenVAS Exploits

Date Description
2010-02-19 Name : SuSE Update for kernel SUSE-SA:2010:012
File : nvt/gb_suse_2010_012.nasl
2009-11-17 Name : SLES10: Security update for Linux kernel
File : nvt/sles10_kernel9.nasl
2009-11-11 Name : Debian Security Advisory DSA 1927-1 (linux-2.6)
File : nvt/deb_1927_1.nasl
2009-11-11 Name : Debian Security Advisory DSA 1928-1 (linux-2.6.24)
File : nvt/deb_1928_1.nasl
2009-11-11 Name : Debian Security Advisory DSA 1929-1 (linux-2.6)
File : nvt/deb_1929_1.nasl
2009-09-21 Name : CentOS Security Advisory CESA-2009:1438 (kernel)
File : nvt/ovcesa2009_1438.nasl
2009-09-15 Name : RedHat Security Advisory RHSA-2009:1438
File : nvt/RHSA_2009_1438.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
58234 Linux Kernel drivers/char/random.c get_random_int Function RNG Weakness

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2009-1106.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2009-1438.nasl - Type : ACT_GATHER_INFO
2012-05-17 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_kernel-6636.nasl - Type : ACT_GATHER_INFO
2012-05-17 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_kernel-6641.nasl - Type : ACT_GATHER_INFO
2010-10-11 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_kernel-6637.nasl - Type : ACT_GATHER_INFO
2010-02-24 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1927.nasl - Type : ACT_GATHER_INFO
2010-02-24 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1928.nasl - Type : ACT_GATHER_INFO
2010-02-24 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1929.nasl - Type : ACT_GATHER_INFO
2010-02-16 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_kernel-100203.nasl - Type : ACT_GATHER_INFO
2010-01-06 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2009-1106.nasl - Type : ACT_GATHER_INFO
2010-01-06 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2009-1438.nasl - Type : ACT_GATHER_INFO
2009-11-11 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_kernel-6632.nasl - Type : ACT_GATHER_INFO
2009-10-22 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-852-1.nasl - Type : ACT_GATHER_INFO
2009-09-16 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1438.nasl - Type : ACT_GATHER_INFO
2009-06-17 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1106.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8...
http://patchwork.kernel.org/patch/21766/
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30
https://bugzilla.redhat.com/show_bug.cgi?id=499785
https://bugzilla.redhat.com/show_bug.cgi?id=519692
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr...
OVAL https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
REDHAT http://www.redhat.com/support/errata/RHSA-2009-1438.html
SECUNIA http://secunia.com/advisories/37105
http://secunia.com/advisories/37351
SUSE http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html
UBUNTU http://www.ubuntu.com/usn/USN-852-1

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Date Informations
2022-10-11 12:09:29
  • Multiple Updates
2022-10-11 01:02:57
  • Multiple Updates
2022-03-11 01:07:56
  • Multiple Updates
2021-05-04 12:10:11
  • Multiple Updates
2021-04-22 01:10:37
  • Multiple Updates
2020-08-08 01:04:34
  • Multiple Updates
2020-08-01 12:04:36
  • Multiple Updates
2020-07-30 01:04:44
  • Multiple Updates
2020-05-23 01:40:52
  • Multiple Updates
2020-05-23 00:24:19
  • Multiple Updates
2019-01-25 12:02:52
  • Multiple Updates
2018-10-30 12:03:03
  • Multiple Updates
2018-07-28 09:19:19
  • Multiple Updates
2017-09-19 09:23:24
  • Multiple Updates
2016-08-05 12:02:13
  • Multiple Updates
2016-06-29 00:07:09
  • Multiple Updates
2016-06-28 17:49:41
  • Multiple Updates
2016-04-26 19:07:12
  • Multiple Updates
2014-02-17 10:51:38
  • Multiple Updates
2013-05-10 23:57:28
  • Multiple Updates