CVE-2011-0766 Weak cryptography in n/a
Predictable random seeds in Erlang OTP SSH allow remote attackers to guess DSA host and session keys, compromising secure connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-0766?
CVE-2011-0766 is a high-severity vulnerability in n/a, published on 31 May 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, which makes it easier for remote attackers to guess DSA host and SSH session keys.
Weakness: CWE-310
Which versions are affected by CVE-2011-0766?
It affects 3 products.
Products include Erlang Crypto, Erlang Erlang\/Otp, Ssh Ssh.
How do I fix CVE-2011-0766?
Upgrade to a fixed version.
Is CVE-2011-0766 being exploited?
There is no known exploitation of CVE-2011-0766 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2011-0766, GHSA-q2pp-3636-pf45.