Vulnerabilities > CVE-2018-1426 - Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in IBM DB2

047910
CVSS 9.1 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
NONE
network
low complexity
ibm
CWE-335
critical
NVD
Published: 2018-03-22
Updated: 2024-11-21

Summary

IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071.

Vulnerable Configurations

Part Description Count
Application
Ibm
4
OS
Linux
1
OS
Microsoft
1

Common Weakness Enumeration (CWE)

References