CVE-2008-5659

Published: Dec 17, 2008Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.

Affected (25)

Products: Gnu: Classpath

Gnu

1 product

Classpath

Configuration A

25 vulnerable

Vulnerable Software	Affected Versions
Gnu Classpath	Up to 0.97.2
Gnu Classpath	Version 0.10
Gnu Classpath	Version 0.11
Gnu Classpath	Version 0.12
Gnu Classpath	Version 0.13
Gnu Classpath	Version 0.14
Gnu Classpath	Version 0.15
Gnu Classpath	Version 0.16
Gnu Classpath	Version 0.17
Gnu Classpath	Version 0.18
Gnu Classpath	Version 0.19
Gnu Classpath	Version 0.20
Gnu Classpath	Version 0.6
Gnu Classpath	Version 0.7
Gnu Classpath	Version 0.8
Gnu Classpath	Version 0.90
Gnu Classpath	Version 0.91
Gnu Classpath	Version 0.92
Gnu Classpath	Version 0.93
Gnu Classpath	Version 0.95
Gnu Classpath	Version 0.96.1
Gnu Classpath	Version 0.96
Gnu Classpath	Version 0.97.1
Gnu Classpath	Version 0.97
Gnu Classpath	Version 0.9

Related CWEs

CWE-310

References (6)

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=38417

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/12/06/2

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/47574

Source: cve@mitre.org

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=38417

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2008/12/06/2

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/47574

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.