Microsoft confirms that XP has random number generator bug

Windows XP, Microsoft Corp.'s most popular operating system, sports the same encryption flaws that Israeli researchers recently disclosed in Windows 2000, Microsoft officials confirmed late Tuesday.

The researchers, Benny Pinkas from the University of Haifa and two Hebrew University graduate students, Zvi Gutterman and Leo Dorrendorf, reverse-engineered the algorithm used by Windows 2000's pseudo-random number generator (PRNG), then used that knowledge to pick apart the operating system's encryption. Attackers could exploit a weakness in the PRNG, said Pinkas and his colleagues, to predict encryption keys that would be created in the future as well as reveal the keys that had been generated in the past.

View: Full Article @ InfoWorld

Report a problem with article
Previous Story

Microsoft Prepares Next Windows Home Server Update

Next Story

Microsoft clears up Zune 80 availability issues

5 Comments

Commenting is disabled on this article.

Linux Kernel Random Number Generator DoS and Privilege Escalation Vulnerability:
http://www.securityfocus.com/bid/25348/discuss

The Linux kernel is prone to a local vulnerability that may result in a DoS or privilege escalation. This issue stems from a stack-based overflow in kernel memory.
Successfully exploiting this issue allows local attackers to trigger kernel crashes. In certain circumstances, attackers may also gain elevated privileges. The attacker may require partial administrative access via granular assignments of superuser privileges.
Linux kernel versions prior to 2.6.22.3 are affected by this issue

MS wants everyone to give them $$$ for Vista so it will probably deliberately NOT be fixed on XP.