Unscored severity · published Oct 11, 2013
CVE-2007-6755
The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible…
–
CVSS
1.6%
EPSS
No
On KEV
Description
The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
Bsafe Crypto-c-micro-edition · Dell
3.0.0.0 through 3.0.0.20 · source: NVD
BC
Bsafe Crypto-j · Dell
5.0; 5.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-6755
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-6755
Third Party Advisory
http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/
Third Party Advisory
http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html
Third Party Advisory
http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html
Third Party Advisory
http://rump2007.cr.yp.to/15-shumow.pdf
Not Applicable
http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/
Third Party Advisory
http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect
More from Bsafe Crypto-c-micro-edition
9.8
CVE-2020-29504
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Missing Required Cryptographic Step Vulnerability
9.8
CVE-2020-35169
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Improper Input Validation Vulnerability
9.8
CVE-2020-35168
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability
9.8
CVE-2020-35167
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability
9.8
CVE-2020-35166
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability
