USN-7024-1: tgt vulnerability
Published Sep 19, 2024
·Updated
It was discovered that tgt attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.
Affected Software
2 affected componentsFixes available
All of the following
ubuntu/tgt<1:1.0.79-2ubuntu1.1
1:1.0.79-2ubuntu1.1
Ubuntu Ubuntu=20.04
Event History
Sep 19, 2024
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the severity of USN-7024-1?
USN-7024-1 is identified as a vulnerability that impacts the randomness of challenge responses due to predictable entropy.
2
How do I fix USN-7024-1?
To fix USN-7024-1, upgrade the tgt package to version 1:1.0.79-2ubuntu1.1 or later.
3
What causes USN-7024-1?
USN-7024-1 is caused by the tgt attempting to generate entropy without properly seeding the random number generator.
4
Which Ubuntu versions are affected by USN-7024-1?
USN-7024-1 affects Ubuntu 20.04 when the tgt package version is less than or equal to 1:1.0.79-2ubuntu1.1.
5
What are the potential impacts of USN-7024-1?
The potential impact of USN-7024-1 is that the predictability of the response challenges can expose systems to replay or impersonation attacks.