CVE-2014-0017

Published: 05 March 2014

The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision.

Priority

Status

Package	Release	Status
libssh Launchpad, Ubuntu, Debian	Upstream	Released (0.6.3)





	Ubuntu 14.04 ESM (Trusty Tahr)	Released (0.6.1-0ubuntu3)
	Patches: Upstream: http://git.libssh.org/projects/libssh.git/commit/?id=e99246246b4061f7e71463f8806b9dcad65affa0

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0017
http://www.openwall.com/lists/oss-security/2014/03/05/1
http://www.libssh.org/2014/03/04/libssh-0-6-3-security-release/
https://usn.ubuntu.com/usn/usn-2145-1
NVD
Launchpad
Debian

Bugs

https://bugzilla.redhat.com/show_bug.cgi?id=1072191

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM