CVE-2007-6150: Infoleak

Published Nov 30, 2007

Updated

The "internal state tracking" code for the random and urandom devices in FreeBSD 5.5, 6.1 through 6.3, and 7.0 beta 4 allows local users to obtain portions of previously-accessed random values, which could be leveraged to bypass protection mechanisms that rely on secrecy of those values.

Affected Software

5 affected components

FreeBSD FreeBSD=6.1

FreeBSD FreeBSD=6.3

FreeBSD FreeBSD=5.5

FreeBSD FreeBSD=6.2

FreeBSD FreeBSD=7.0-beta_4

Remediation

Patch Available

http://security.FreeBSD.org/advisories/FreeBSD-SA-07:09.random.asc

Event History

Nov 30, 2007

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-6150?

CVE-2007-6150 is classified as a moderate severity vulnerability due to its ability to allow local users to access sensitive random values.

How do I fix CVE-2007-6150?

To fix CVE-2007-6150, you should upgrade your FreeBSD version to one that includes the security patch for this vulnerability.

Which FreeBSD versions are affected by CVE-2007-6150?

CVE-2007-6150 affects FreeBSD versions 5.5, 6.1 through 6.3, and 7.0 beta 4.

What exploits are associated with CVE-2007-6150?

CVE-2007-6150 could be exploited by local users to obtain previous random values, potentially bypassing security mechanisms.

Is CVE-2007-6150 a remote or local vulnerability?

CVE-2007-6150 is a local vulnerability that requires local access to the FreeBSD system.