CVE-2010-3399

2010-09-1520:00:02

CWE-310

mitre

web.nvd.nist.gov

cve

mozilla

firefox

javascript

vulnerability

remote attackers

seed value

brute-force attack

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

AI Score

8.7

Confidence

High

EPSS

0.021

Percentile

89.1%

JSON

The js_InitRandom function in the JavaScript implementation in Mozilla Firefox 3.5.10 through 3.5.11, 3.6.4 through 3.6.8, and 4.0 Beta1 uses a context pointer in conjunction with its successor pointer for seeding of a random number generator, which makes it easier for remote attackers to guess the seed value via a brute-force attack, a different vulnerability than CVE-2010-3171.

Affected configurations

Nvd

Node

mozillafirefoxMatch3.5.10

mozillafirefoxMatch3.5.11

mozillafirefoxMatch3.6.4

mozillafirefoxMatch3.6.6

mozillafirefoxMatch3.6.7

mozillafirefoxMatch3.6.8

mozillafirefoxMatch4.0beta1

VendorProductVersionCPE
mozillafirefox3.5.10cpe:2.3:a:mozilla:firefox:3.5.10:*:*:*:*:*:*:*
mozillafirefox3.5.11cpe:2.3:a:mozilla:firefox:3.5.11:*:*:*:*:*:*:*
mozillafirefox3.6.4cpe:2.3:a:mozilla:firefox:3.6.4:*:*:*:*:*:*:*
mozillafirefox3.6.6cpe:2.3:a:mozilla:firefox:3.6.6:*:*:*:*:*:*:*
mozillafirefox3.6.7cpe:2.3:a:mozilla:firefox:3.6.7:*:*:*:*:*:*:*
mozillafirefox3.6.8cpe:2.3:a:mozilla:firefox:3.6.8:*:*:*:*:*:*:*
mozillafirefox4.0cpe:2.3:a:mozilla:firefox:4.0:beta1:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	firefox	3.5.10	cpe:2.3:a:mozilla:firefox:3.5.10:::::::*
mozilla	firefox	3.5.11	cpe:2.3:a:mozilla:firefox:3.5.11:::::::*
mozilla	firefox	3.6.4	cpe:2.3:a:mozilla:firefox:3.6.4:::::::*
mozilla	firefox	3.6.6	cpe:2.3:a:mozilla:firefox:3.6.6:::::::*
mozilla	firefox	3.6.7	cpe:2.3:a:mozilla:firefox:3.6.7:::::::*
mozilla	firefox	3.6.8	cpe:2.3:a:mozilla:firefox:3.6.8:::::::*
mozilla	firefox	4.0	cpe:2.3:a:mozilla:firefox:4.0:beta1::::::