CVE-2001-1467 mkpasswd in expect 5.2.8, as used by Red Hat Linux 6.2 through 7.0, seeds its random number generator with its process ID, which limits the space of possible seeds and makes it easier for attackers to...
HighCVSS 7.5
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
mkpasswd in expect 5.2.8, as used by Red Hat Linux 6.2 through 7.0, seeds its random number generator with its process ID, which limits the space of possible seeds and makes it easier for attackers to conduct brute force password attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| don libes expect | = 5.2.8 | No fix listed |
References
- 20010411 flaw in RH ``mkpasswd'' command mailing-list
- 20010412 Re: flaw in RH ``mkpasswd'' command (importance of seeds & algorithms) mailing-list
- 1001303 vdb-entry
- VU#527736 third-party-advisory us-government-resource
- 2632 vdb-entry
- mkpasswd-weak-passwords(6382) vdb-entry
- Debian Security Tracker CVE-2001-1467 vendor-advisory