NetSight
IP …
medium5.0

CVE-2006-3419

Tor before 0.1.1.20 uses OpenSSL pseudo-random bytes (RAND_pseudo_bytes) instead of cryptographically strong RAND_bytes, and seeds the entropy value at start-u…

Impact

Tor before 0.1.1.20 uses OpenSSL pseudo-random bytes (RAND_pseudo_bytes) instead of cryptographically strong RAND_bytes, and seeds the entropy value at start-up with 160-bit chunks without reseeding, which makes it easier for attackers to conduct brute force guessing attacks.

Affected products

VendorProductAffected versions
TorTor
Versions 0.0.2, 0.0.2_pre13, 0.0.2_pre14, 0.0.2_pre15, 0.0.2_pre16, 0.0.2_pre17

References