CVE-2014-9687 eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack.
MediumCVSS 5.0
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ecryptfs-utils(Debian:12) | < 103-4 | 103-4 |
| debian/ecryptfs-utils(Debian:13) | < 103-4 | 103-4 |
| debian/ecryptfs-utils(Debian:14) | < 103-4 | 103-4 |
| ecryptfs-utils | <= 104 | No fix listed |
References
- Debian Security Tracker CVE-2014-9687 vendor-advisory
- openSUSE-SU-2016:0291 vendor-advisory
- [oss-security] 20150210 Re: eCryptfs key wrapping help to crack user password mailing-list
- [oss-security] 20150217 CVE request: Linux kernel ecryptfs 1-byte overwrite mailing-list
- [oss-security] 20150227 Re: eCryptfs key wrapping help to crack user password mailing-list
- USN-2524-1 vendor-advisory
- bugs.launchpad.net exploit
- bugs.debian.org issue-tracking