CVE-2007-6150 - Vulnerability Details - OpenCVE

The "internal state tracking" code for the random and urandom devices in FreeBSD 5.5, 6.1 through 6.3, and 7.0 beta 4 allows local users to obtain portions of previously-accessed random values, which could be leveraged to bypass protection mechanisms that rely on secrecy of those values.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Freebsd	Freebsd

Configuration 1 [-]

OR	cpe:2.3:o:freebsd:freebsd:5.5:::::::*
	cpe:2.3:o:freebsd:freebsd:6.1:::::::*
	cpe:2.3:o:freebsd:freebsd:6.2:::::::*
	cpe:2.3:o:freebsd:freebsd:6.3:::::::*
	cpe:2.3:o:freebsd:freebsd:7.0:beta_4::::::

No data.

References

Link	Providers
http://osvdb.org/39600
http://secunia.com/advisories/27879
http://security.FreeBSD.org/advisories/FreeBSD-SA-07:09.random.asc
http://www.securityfocus.com/bid/26642
http://www.securitytracker.com/id?1019022
http://www.vupen.com/english/advisories/2007/4053
https://exchange.xforce.ibmcloud.com/vulnerabilities/38764

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-11-30T01:00:00

Updated: 2024-08-07T15:54:26.916Z

Reserved: 2007-11-27T00:00:00

Link: CVE-2007-6150

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-11-30T01:46:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-6150

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-11-29T00:00:00", "descriptions": [{"lang": "en", "value": "The \"internal state tracking\" code for the random and urandom devices in FreeBSD 5.5, 6.1 through 6.3, and 7.0 beta 4 allows local users to obtain portions of previously-accessed random values, which could be leveraged to bypass protection mechanisms that rely on secrecy of those values."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "26642", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/26642"}, {"name": "FreeBSD-SA-07:09", "tags": ["vendor-advisory", "x_refsource_FREEBSD"], "url": "http://security.FreeBSD.org/advisories/FreeBSD-SA-07:09.random.asc"}, {"name": "1019022", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1019022"}, {"name": "freebsd-sysdevrandom-information-disclosure(38764)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38764"}, {"name": "27879", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/27879"}, {"name": "39600", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/39600"}, {"name": "ADV-2007-4053", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/4053"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-6150", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The \"internal state tracking\" code for the random and urandom devices in FreeBSD 5.5, 6.1 through 6.3, and 7.0 beta 4 allows local users to obtain portions of previously-accessed random values, which could be leveraged to bypass protection mechanisms that rely on secrecy of those values."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "26642", "refsource": "BID", "url": "http://www.securityfocus.com/bid/26642"}, {"name": "FreeBSD-SA-07:09", "refsource": "FREEBSD", "url": "http://security.FreeBSD.org/advisories/FreeBSD-SA-07:09.random.asc"}, {"name": "1019022", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1019022"}, {"name": "freebsd-sysdevrandom-information-disclosure(38764)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38764"}, {"name": "27879", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/27879"}, {"name": "39600", "refsource": "OSVDB", "url": "http://osvdb.org/39600"}, {"name": "ADV-2007-4053", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/4053"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T15:54:26.916Z"}, "title": "CVE Program Container", "references": [{"name": "26642", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/26642"}, {"name": "FreeBSD-SA-07:09", "tags": ["vendor-advisory", "x_refsource_FREEBSD", "x_transferred"], "url": "http://security.FreeBSD.org/advisories/FreeBSD-SA-07:09.random.asc"}, {"name": "1019022", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1019022"}, {"name": "freebsd-sysdevrandom-information-disclosure(38764)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38764"}, {"name": "27879", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/27879"}, {"name": "39600", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/39600"}, {"name": "ADV-2007-4053", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/4053"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-6150", "datePublished": "2007-11-30T01:00:00", "dateReserved": "2007-11-27T00:00:00", "dateUpdated": "2024-08-07T15:54:26.916Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:freebsd:freebsd:5.5:*:*:*:*:*:*:*", "matchCriteriaId": "7752D43D-64AF-474F-BFBB-2625A29C1B88", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:6.1:*:*:*:*:*:*:*", "matchCriteriaId": "F4416CBA-76B9-4051-B015-F1BE89517309", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:6.2:*:*:*:*:*:*:*", "matchCriteriaId": "9118B602-3FB6-4701-AC09-763DD48334BA", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:6.3:*:*:*:*:*:*:*", "matchCriteriaId": "F702C46F-CA02-4FA2-B7D6-C61C2C095679", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:7.0:beta_4:*:*:*:*:*:*", "matchCriteriaId": "CDFA5AA9-E73F-448D-9754-41AF9AECB93A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The \"internal state tracking\" code for the random and urandom devices in FreeBSD 5.5, 6.1 through 6.3, and 7.0 beta 4 allows local users to obtain portions of previously-accessed random values, which could be leveraged to bypass protection mechanisms that rely on secrecy of those values."}, {"lang": "es", "value": "El c\u00f3digo de \"seguimiento del estado interno\" para los dispositivos random y urandom de FreeBSD 5.5, 6.1 hasta 6.3, y 7.0 beta 4 permite a usuarios locales obtener parte de valores aleatorios que han sido accedidos previamente, lo cual podr\u00eda aprovechado para evitar los mecanismos de protecci\u00f3n basados en mantener estos valores en secreto."}], "id": "CVE-2007-6150", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-11-30T01:46:00.000", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/39600"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/27879"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://security.FreeBSD.org/advisories/FreeBSD-SA-07:09.random.asc"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/26642"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1019022"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2007/4053"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38764"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/39600"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/27879"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://security.FreeBSD.org/advisories/FreeBSD-SA-07:09.random.asc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/26642"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1019022"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/4053"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38764"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}