Test ID:	1.3.6.1.4.1.25623.1.0.61921
Category:	FreeBSD Local Security Checks
Title:	FreeBSD Security Advisory (FreeBSD-SA-08:11.arc4random.asc)
Summary:	The remote host is missing an update to the system; as announced in the referenced advisory FreeBSD-SA-08:11.arc4random.asc
Description:	Summary: The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-08:11.arc4random.asc Vulnerability Insight: arc4random(9) is a generic-purpose random number generator based on the key stream generator of the RC4 cipher. It is expected to be cryptographically strong, and used throughout the FreeBSD kernel for a variety of purposes, some of which rely on its cryptographic strength. arc4random(9) is periodically reseeded with entropy from the FreeBSD kernel's Yarrow random number generator, which gathers entropy from a variety of sources including hardware interrupts. During the boot process, additional entropy is provided to the Yarrow random number generator from userland, helping to ensure that adequate entropy is present for cryptographic purposes. When the arc4random(9) random number generator is initialized, there may be inadequate entropy to meet the needs of kernel systems which rely on arc4random(9), and it may take up to 5 minutes before arc4random(9) is reseeded with secure entropy from the Yarrow random number generator. Solution: Upgrade your system to the appropriate stable release or security branch dated after the correction date. CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2008-5162 BugTraq ID: 32447 http://www.securityfocus.com/bid/32447 FreeBSD Security Advisory: FreeBSD-SA-08:11 http://security.freebsd.org/advisories/FreeBSD-SA-08:11.arc4random.asc http://osvdb.org/50137 http://securitytracker.com/id?1021276 http://secunia.com/advisories/32871
Copyright	Copyright (C) 2008 E-Soft Inc.

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.