CVE-2007-6755

{"id": "CVE-2007-6755", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-10-11T22:55:33.580", "references": [{"url": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/", "tags": ["Third Party Advisory"], "source": "secalert_us@oracle.com"}, {"url": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html", "tags": ["Third Party Advisory"], "source": "secalert_us@oracle.com"}, {"url": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html", "tags": ["Third Party Advisory"], "source": "secalert_us@oracle.com"}, {"url": "http://rump2007.cr.yp.to/15-shumow.pdf", "tags": ["Third Party Advisory"], "source": "secalert_us@oracle.com"}, {"url": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/", "tags": ["Not Applicable"], "source": "secalert_us@oracle.com"}, {"url": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect", "tags": ["Third Party Advisory"], "source": "secalert_us@oracle.com"}, {"url": "http://www.securityfocus.com/bid/63657", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secalert_us@oracle.com"}, {"url": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html", "tags": ["Third Party Advisory"], "source": "secalert_us@oracle.com"}, {"url": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rump2007.cr.yp.to/15-shumow.pdf", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/63657", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-327"}]}], "descriptions": [{"lang": "en", "value": "The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain \"skeleton key\" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE."}, {"lang": "es", "value": "El procedimiento por defecto del NIST SP 800-90A del algoritmo Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) contiene puntos constantes Q con una posible relaci\u00f3n con ciertos valores \"skeleton key\", lo que podr\u00eda permitir a atacantes dependientes del contexto romper mecanismos criptogr\u00e1ficos de protecci\u00f3n mediante el aprovechando del conocimiento de esos valores. NOTA: este es un CVE preliminar para Dual_EC_DRBG, la investigaci\u00f3n futura puede brindar detalles adicionales sobre el punto Q y los ataques asociados, y podr\u00eda potencialmente dar lugar a un RECAST o REJECT de esta CVE."}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:bsafe_crypto-c-micro-edition:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBC91A27-A2F7-40BD-8C2B-8AD5B042DC1F", "versionEndIncluding": "3.0.0.20", "versionStartIncluding": "3.0.0.0"}, {"criteria": "cpe:2.3:a:dell:bsafe_crypto-j:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40C23A4D-1F95-422E-946B-9063BC5F8395"}, {"criteria": "cpe:2.3:a:dell:bsafe_crypto-j:5.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86B6427C-851F-4060-8A09-F6E2955269B1"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}