CVE-2008-0166: Weak RNG
Published May 13, 2008
·Updated
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
Affected Software
15 affected components
OpenSSL OpenSSL>=0.9.8c-1<=0.9.8g
Canonical Ubuntu Linux=6.06
Canonical Ubuntu Linux=7.04
Canonical Ubuntu Linux=7.10
Canonical Ubuntu Linux=8.04
Debian Debian Linux=4.0
OpenSSL OpenSSL=0.9.8c-1
OpenSSL OpenSSL=0.9.8d
OpenSSL OpenSSL=0.9.8e
OpenSSL OpenSSL=0.9.8f
OpenSSL OpenSSL=0.9.8g
Canonical Ubuntu Linux=7.04
Canonical Ubuntu Linux=7.10
Canonical Ubuntu Linux=8.04
Debian Debian Linux=4.0
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
May 13, 2008
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Data Sourced
05:20 PM
DescriptionWeaknessAffected Software
Data Sourced
via NVD·05:20 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2008-0166?
CVE-2008-0166 is considered a high severity vulnerability due to its potential to facilitate brute force attacks on cryptographic keys.
2
How do I fix CVE-2008-0166?
To fix CVE-2008-0166, upgrade OpenSSL to version 0.9.8g or later.
3
What versions of OpenSSL are affected by CVE-2008-0166?
CVE-2008-0166 affects OpenSSL versions from 0.9.8c-1 up to 0.9.8g.
4
What are the potential impacts of CVE-2008-0166?
The potential impacts of CVE-2008-0166 include unauthorized access to sensitive data through key compromise.
5
Is CVE-2008-0166 specific to a certain operating system?
CVE-2008-0166 specifically affects Debian-based operating systems that use the vulnerable versions of OpenSSL.