FreeBSD : libssh -- PRNG state reuse on forking servers (f8c88d50-5fb3-11e4-81bd-5453ed2e2b49)
Low Nessus Plugin ID 78730
SynopsisThe remote FreeBSD host is missing a security-related update.
DescriptionAris Adamantiadis reports :
When accepting a new connection, the server forks and the child process handles the request. The RAND_bytes() function of openssl doesn't reset its state after the fork, but simply adds the current process id (getpid) to the PRNG state, which is not guaranteed to be unique.
SolutionUpdate the affected package.