Vulnerabilities
Misconfiguration
Runtime Security
Compliance
CVE Vulnerabilities

CVE-2015-5276

Exposure of Sensitive Information to an Unauthorized Actor

Published: Nov 17, 2015 | Modified: Feb 12, 2019
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
3.3 LOW
AV:L/AC:M/Au:N/C:P/I:P/A:N
RedHat/V3
Ubuntu
LOW
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2015-5276
CWEhttps://cwe.mitre.org/data/definitions/200.html

The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors.

Weakness

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected Software

Name Vendor Start Version End Version
Gcc Gnu * 4.9.4 (excluding)
Gcc-4.4 Ubuntu precise *
Gcc-4.4 Ubuntu trusty *
Gcc-4.4 Ubuntu upstream *
Gcc-4.4 Ubuntu vivid *
Gcc-4.4-armel-cross Ubuntu precise *
Gcc-4.4-armhf-cross Ubuntu precise *
Gcc-4.5 Ubuntu precise *
Gcc-4.5 Ubuntu upstream *
Gcc-4.5-armel-cross Ubuntu precise *
Gcc-4.5-armhf-cross Ubuntu precise *
Gcc-4.6 Ubuntu precise *
Gcc-4.6 Ubuntu precise/esm *
Gcc-4.6 Ubuntu trusty *
Gcc-4.6 Ubuntu upstream *
Gcc-4.6 Ubuntu vivid *
Gcc-4.6-armel-cross Ubuntu precise *
Gcc-4.6-armhf-cross Ubuntu precise *
Gcc-4.7 Ubuntu esm-apps/xenial *
Gcc-4.7 Ubuntu esm-infra-legacy/trusty *
Gcc-4.7 Ubuntu trusty *
Gcc-4.7 Ubuntu trusty/esm *
Gcc-4.7 Ubuntu upstream *
Gcc-4.7 Ubuntu vivid *
Gcc-4.7 Ubuntu wily *
Gcc-4.7 Ubuntu xenial *
Gcc-4.7 Ubuntu yakkety *
Gcc-4.7 Ubuntu zesty *
Gcc-4.7-armel-cross Ubuntu esm-apps/xenial *
Gcc-4.7-armel-cross Ubuntu trusty *
Gcc-4.7-armel-cross Ubuntu upstream *
Gcc-4.7-armel-cross Ubuntu vivid *
Gcc-4.7-armel-cross Ubuntu wily *
Gcc-4.7-armel-cross Ubuntu xenial *
Gcc-4.7-armel-cross Ubuntu yakkety *
Gcc-4.7-armel-cross Ubuntu zesty *
Gcc-4.7-armhf-cross Ubuntu esm-apps/xenial *
Gcc-4.7-armhf-cross Ubuntu trusty *
Gcc-4.7-armhf-cross Ubuntu upstream *
Gcc-4.7-armhf-cross Ubuntu vivid *
Gcc-4.7-armhf-cross Ubuntu wily *
Gcc-4.7-armhf-cross Ubuntu xenial *
Gcc-4.7-armhf-cross Ubuntu yakkety *
Gcc-4.7-armhf-cross Ubuntu zesty *
Gcc-4.8 Ubuntu artful *
Gcc-4.8 Ubuntu bionic *
Gcc-4.8 Ubuntu cosmic *
Gcc-4.8 Ubuntu esm-apps/bionic *
Gcc-4.8 Ubuntu esm-apps/xenial *
Gcc-4.8 Ubuntu esm-infra-legacy/trusty *
Gcc-4.8 Ubuntu trusty *
Gcc-4.8 Ubuntu trusty/esm *
Gcc-4.8 Ubuntu upstream *
Gcc-4.8 Ubuntu vivid *
Gcc-4.8 Ubuntu wily *
Gcc-4.8 Ubuntu xenial *
Gcc-4.8 Ubuntu yakkety *
Gcc-4.8 Ubuntu zesty *
Gcc-4.8-arm64-cross Ubuntu esm-apps/xenial *
Gcc-4.8-arm64-cross Ubuntu trusty *
Gcc-4.8-arm64-cross Ubuntu upstream *
Gcc-4.8-arm64-cross Ubuntu vivid *
Gcc-4.8-arm64-cross Ubuntu wily *
Gcc-4.8-arm64-cross Ubuntu xenial *
Gcc-4.8-armhf-cross Ubuntu esm-apps/xenial *
Gcc-4.8-armhf-cross Ubuntu trusty *
Gcc-4.8-armhf-cross Ubuntu upstream *
Gcc-4.8-armhf-cross Ubuntu vivid *
Gcc-4.8-armhf-cross Ubuntu wily *
Gcc-4.8-armhf-cross Ubuntu xenial *
Gcc-4.8-powerpc-cross Ubuntu esm-apps/xenial *
Gcc-4.8-powerpc-cross Ubuntu trusty *
Gcc-4.8-powerpc-cross Ubuntu upstream *
Gcc-4.8-powerpc-cross Ubuntu vivid *
Gcc-4.8-powerpc-cross Ubuntu wily *
Gcc-4.8-powerpc-cross Ubuntu xenial *
Gcc-4.8-ppc64el-cross Ubuntu esm-apps/xenial *
Gcc-4.8-ppc64el-cross Ubuntu trusty *
Gcc-4.8-ppc64el-cross Ubuntu upstream *
Gcc-4.8-ppc64el-cross Ubuntu vivid *
Gcc-4.8-ppc64el-cross Ubuntu wily *
Gcc-4.8-ppc64el-cross Ubuntu xenial *
Gcc-4.9 Ubuntu upstream *
Gcc-4.9 Ubuntu vivid *
Gcc-4.9 Ubuntu vivid/stable-phone-overlay *
Gcc-4.9 Ubuntu vivid/ubuntu-core *
Gcc-4.9-arm64-cross Ubuntu vivid *
Gcc-4.9-armhf-cross Ubuntu vivid *
Gcc-4.9-powerpc-cross Ubuntu vivid *
Gcc-4.9-ppc64el-cross Ubuntu vivid *
Gcc-5 Ubuntu upstream *
Gcc-5 Ubuntu wily *
Gcc-arm-linux-androideabi Ubuntu esm-apps/xenial *
Gcc-arm-linux-androideabi Ubuntu trusty *
Gcc-arm-linux-androideabi Ubuntu upstream *
Gcc-arm-linux-androideabi Ubuntu vivid *
Gcc-arm-linux-androideabi Ubuntu wily *
Gcc-arm-linux-androideabi Ubuntu xenial *
Gcc-arm-linux-androideabi Ubuntu yakkety *
Gcc-arm-linux-androideabi Ubuntu zesty *
Gcc-arm-none-eabi Ubuntu artful *
Gcc-arm-none-eabi Ubuntu esm-apps/xenial *
Gcc-arm-none-eabi Ubuntu trusty *
Gcc-arm-none-eabi Ubuntu upstream *
Gcc-arm-none-eabi Ubuntu vivid *
Gcc-arm-none-eabi Ubuntu wily *
Gcc-arm-none-eabi Ubuntu xenial *
Gcc-arm-none-eabi Ubuntu yakkety *
Gcc-arm-none-eabi Ubuntu zesty *
Gcc-avr Ubuntu artful *
Gcc-avr Ubuntu esm-apps/xenial *
Gcc-avr Ubuntu precise *
Gcc-avr Ubuntu trusty *
Gcc-avr Ubuntu upstream *
Gcc-avr Ubuntu vivid *
Gcc-avr Ubuntu wily *
Gcc-avr Ubuntu xenial *
Gcc-avr Ubuntu yakkety *
Gcc-avr Ubuntu zesty *
Gcc-h8300-hms Ubuntu artful *
Gcc-h8300-hms Ubuntu precise *
Gcc-h8300-hms Ubuntu vivid *
Gcc-h8300-hms Ubuntu wily *
Gcc-h8300-hms Ubuntu yakkety *
Gcc-h8300-hms Ubuntu zesty *
Gcc-i686-linux-android Ubuntu esm-apps/xenial *
Gcc-i686-linux-android Ubuntu trusty *
Gcc-i686-linux-android Ubuntu vivid *
Gcc-i686-linux-android Ubuntu wily *
Gcc-i686-linux-android Ubuntu xenial *
Gcc-i686-linux-android Ubuntu yakkety *
Gcc-i686-linux-android Ubuntu zesty *
Gcc-m68hc1x Ubuntu artful *
Gcc-m68hc1x Ubuntu precise *
Gcc-m68hc1x Ubuntu vivid *
Gcc-m68hc1x Ubuntu wily *
Gcc-m68hc1x Ubuntu yakkety *
Gcc-m68hc1x Ubuntu zesty *
Gcc-mingw-w64 Ubuntu artful *
Gcc-mingw-w64 Ubuntu esm-infra-legacy/trusty *
Gcc-mingw-w64 Ubuntu precise *
Gcc-mingw-w64 Ubuntu trusty *
Gcc-mingw-w64 Ubuntu trusty/esm *
Gcc-mingw-w64 Ubuntu vivid *
Gcc-mingw-w64 Ubuntu wily *
Gcc-mingw-w64 Ubuntu yakkety *
Gcc-mingw-w64 Ubuntu zesty *
Gcc-msp430 Ubuntu artful *
Gcc-msp430 Ubuntu bionic *
Gcc-msp430 Ubuntu cosmic *
Gcc-msp430 Ubuntu disco *
Gcc-msp430 Ubuntu eoan *
Gcc-msp430 Ubuntu esm-apps/bionic *
Gcc-msp430 Ubuntu esm-apps/focal *
Gcc-msp430 Ubuntu esm-apps/jammy *
Gcc-msp430 Ubuntu esm-apps/xenial *
Gcc-msp430 Ubuntu focal *
Gcc-msp430 Ubuntu groovy *
Gcc-msp430 Ubuntu hirsute *
Gcc-msp430 Ubuntu impish *
Gcc-msp430 Ubuntu jammy *
Gcc-msp430 Ubuntu kinetic *
Gcc-msp430 Ubuntu lunar *
Gcc-msp430 Ubuntu mantic *
Gcc-msp430 Ubuntu precise *
Gcc-msp430 Ubuntu trusty *
Gcc-msp430 Ubuntu vivid *
Gcc-msp430 Ubuntu wily *
Gcc-msp430 Ubuntu xenial *
Gcc-msp430 Ubuntu yakkety *
Gcc-msp430 Ubuntu zesty *
Gcc-opt Ubuntu artful *
Gcc-opt Ubuntu precise *
Gcc-opt Ubuntu trusty *
Gcc-opt Ubuntu vivid *
Gcc-opt Ubuntu wily *
Gcc-opt Ubuntu yakkety *
Gcc-opt Ubuntu zesty *
Gcc-snapshot Ubuntu precise *
Gcc-snapshot Ubuntu trusty *
Gcc-snapshot Ubuntu upstream *
Gcc-snapshot Ubuntu vivid *

Extended Description

There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker. Some kinds of sensitive information include:

Information might be sensitive to different parties, each of which may have their own expectations for whether the information should be protected. These parties include:

Information exposures can occur in different ways:

It is common practice to describe any loss of confidentiality as an “information exposure,” but this can lead to overuse of CWE-200 in CWE mapping. From the CWE perspective, loss of confidentiality is a technical impact that can arise from dozens of different weaknesses, such as insecure file permissions or out-of-bounds read. CWE-200 and its lower-level descendants are intended to cover the mistakes that occur in behaviors that explicitly manage, store, transfer, or cleanse sensitive information.

Potential Mitigations

  • Compartmentalize the system to have “safe” areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
  • Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2024 Aqua Security Software Ltd.   Privacy Policy | Terms of Use