« Volver al listado

CVE-2024-57854

Estado: AnalizadaCrítica (9.1)—

Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator.

Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors.

Data::Rand::Obscure uses Perl's built-in rand() function, which is not suitable for cryptographic functions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/PR:N sugiere acceso remoto sin privilegios (T1190), pero la vulnerabilidad es de PRNG débil en criptografía, no ejecución remota directa. El impacto real es comprometer la confidencialidad de IVs aleatorios, permitiendo ataques criptográficos y recuperación de credenciales (C:H, I:H). CWE-338 c

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Network SegmentationApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareApplication Developer GuidanceVulnerability Scanning

Tecnologías afectadas (1)

Dougdude — Net\

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-57854",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-57854",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-05T16:40:27.714179Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "repo": "https://github.com/dougwilson/perl5-net-nsca-client",
          "vendor": "DOUGDUDE",
          "product": "Net::NSCA::Client",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "0.009002"
            }
          ],
          "packageName": "Net-NSCA-Client",
          "programFiles": [
            "lib/Net/NSCA/Client/InitialPacket.pm"
          ],
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "_build_initialization_vector"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-05T03:15:53.953",
  "references": [
    {
      "url": "https://metacpan.org/release/DOUGDUDE/Net-NSCA-Client-0.009002/source/lib/Net/NSCA/Client/InitialPacket.pm#L119",
      "tags": [
        "Issue Tracking",
        "Product"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://patch-diff.githubusercontent.com/raw/dougwilson/perl5-net-nsca-client/pull/2.patch",
      "tags": [
        "Patch"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/03/05/1",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "description": [
        {
          "lang": "en",
          "value": "CWE-338"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator.\n\nVersion v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors.\n\nData::Rand::Obscure uses Perl's built-in rand() function, which is not suitable for cryptographic functions."
    },
    {
      "lang": "es",
      "value": "Las versiones de Net::NSCA::Client hasta la 0.009002 para Perl utilizan un generador de números aleatorios deficiente.\n\nLa versión v0.003 pasó a usar Data::Rand::Obscure en lugar de Crypt::Random para la generación de vectores de inicialización aleatorios.\n\nData::Rand::Obscure utiliza la función rand() integrada de Perl, que no es adecuada para funciones criptográficas."
    }
  ],
  "lastModified": "2026-06-17T08:14:06.687",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dougdude:net\\:\\:nsca\\:\\:client:*:*:*:*:*:perl:*:*",
              "vulnerable": true,
              "matchCriteriaId": "596EC9E9-7807-4667-B29C-AC776AB84D21",
              "versionEndIncluding": "0.009002"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
}