Vulnerability CVE-2013-7373 - CERT Civis.Net

Vulnerability Name:

CVE-2013-7373 (CCN-86482)

Assigned:

2013-08-14

Published:

2013-08-14

Updated:

2014-04-30

Summary:

Android before 4.4 does not properly arrange for seeding of the OpenSSL PRNG, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging use of the PRNG within multiple applications.

CVSS v3 Severity:

4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

2.1 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)
1.6 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Other

References:

Source: CCN
Type: Android Developer's Blog, 14 August 2013
Some SecureRandom Thoughts

Source: CONFIRM
Type: UNKNOWN
http://android-developers.blogspot.com.au/2013/08/some-securerandom-thoughts.html

Source: CCN
Type: Google Web site
Android

Source: MITRE
Type: CNA
CVE-2013-7373

Source: MISC
Type: UNKNOWN
http://emboss.github.io/blog/2013/08/21/openssl-prng-is-not-really-fork-safe/

Source: MLIST
Type: UNKNOWN
[openssl-dev] 20110415 recycled pids causes PRNG to repeat

Source: MLIST
Type: UNKNOWN
[openssl-dev] 20110416 Re: recycled pids causes PRNG to repeat

Source: MISC
Type: UNKNOWN
http://www.reddit.com/r/Android/comments/1k6f03/due_to_a_serious_encryptionrng_flaw_in_android/cblvum5

Source: CCN
Type: BID-61813
Google Android PRNG Entropy Weakness

Source: XF
Type: UNKNOWN
google-android-prng-weak-security(86482)

Vulnerable Configuration:

Configuration 1:

cpe:/o:google:android:1.0:*:*:*:*:*:*:*

OR cpe:/o:google:android:1.1:*:*:*:*:*:*:*

OR cpe:/o:google:android:1.5:*:*:*:*:*:*:*

OR cpe:/o:google:android:1.6:*:*:*:*:*:*:*

OR cpe:/o:google:android:2.0:*:*:*:*:*:*:*

OR cpe:/o:google:android:2.0.1:*:*:*:*:*:*:*

OR cpe:/o:google:android:2.1:*:*:*:*:*:*:*

OR cpe:/o:google:android:2.2:*:*:*:*:*:*:*

OR cpe:/o:google:android:2.2:rev1:*:*:*:*:*:*

OR cpe:/o:google:android:2.2.1:*:*:*:*:*:*:*

OR cpe:/o:google:android:2.2.2:*:*:*:*:*:*:*

OR cpe:/o:google:android:2.2.3:*:*:*:*:*:*:*

OR cpe:/o:google:android:2.3:*:*:*:*:*:*:*

OR cpe:/o:google:android:2.3:rev1:*:*:*:*:*:*

OR cpe:/o:google:android:2.3.1:*:*:*:*:*:*:*

OR cpe:/o:google:android:2.3.2:*:*:*:*:*:*:*

OR cpe:/o:google:android:2.3.3:*:*:*:*:*:*:*

OR cpe:/o:google:android:2.3.4:*:*:*:*:*:*:*

OR cpe:/o:google:android:2.3.5:*:*:*:*:*:*:*

OR cpe:/o:google:android:2.3.6:*:*:*:*:*:*:*

OR cpe:/o:google:android:2.3.7:*:*:*:*:*:*:*

OR cpe:/o:google:android:3.0:*:*:*:*:*:*:*

OR cpe:/o:google:android:3.1:*:*:*:*:*:*:*

OR cpe:/o:google:android:3.2:*:*:*:*:*:*:*

OR cpe:/o:google:android:3.2.1:*:*:*:*:*:*:*

OR cpe:/o:google:android:3.2.2:*:*:*:*:*:*:*

OR cpe:/o:google:android:3.2.4:*:*:*:*:*:*:*

OR cpe:/o:google:android:3.2.6:*:*:*:*:*:*:*

OR cpe:/o:google:android:4.0:*:*:*:*:*:*:*

OR cpe:/o:google:android:4.0.1:*:*:*:*:*:*:*

OR cpe:/o:google:android:4.0.2:*:*:*:*:*:*:*

OR cpe:/o:google:android:4.0.3:*:*:*:*:*:*:*

OR cpe:/o:google:android:4.0.4:*:*:*:*:*:*:*

OR cpe:/o:google:android:4.1:*:*:*:*:*:*:*

OR cpe:/o:google:android:4.1.2:*:*:*:*:*:*:*

OR cpe:/o:google:android:4.2:*:*:*:*:*:*:*

OR cpe:/o:google:android:4.2.1:*:*:*:*:*:*:*

OR cpe:/o:google:android:4.2.2:*:*:*:*:*:*:*

OR cpe:/o:google:android:4.3:*:*:*:*:*:*:*

OR cpe:/o:google:android:*:*:*:*:*:*:*:* (Version <= 4.3.1)

Configuration CCN 1:

cpe:/o:google:android:*:*:*:*:*:*:*:*

Denotes that component is vulnerable