A certain pseudo-random number generator (PRNG) algorithm that uses XOR and 3-bit random hops (aka "Algorithm X3"), as used in OpenBSD 2.8 up to and including 4.2, allows remote malicious users to guess sensitive values such as DNS transaction IDs by observing a sequence of previously generated values. NOTE: this issue can be leveraged for attacks such as DNS cache poisoning against OpenBSD's modification of BIND.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
darwin darwin 9.1 |
||
navision financials_server 3.0 |
||
cosmicperl directory_pro 10.0.3 |
||
darwin darwin 1.0 |
Vulmon