CVE-2016-4484 The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts with an invalid password.
MediumCVSS 6.8
EPSS 0.71%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts with an invalid password.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/cryptsetup(Debian:12) | < 2:1.7.3-2 | 2:1.7.3-2 |
| debian/cryptsetup(Debian:13) | < 2:1.7.3-2 | 2:1.7.3-2 |
| debian/cryptsetup(Debian:14) | < 2:1.7.3-2 | 2:1.7.3-2 |
| cryptsetup project cryptsetup | <= 2.1.7.3-2 | No fix listed |
References
- Debian Security Tracker CVE-2016-4484 vendor-advisory
- hmarco.org exploit mitigation technical-description third-party-advisory
- [oss-security] 20161114 CVE-2016-4484: - Cryptsetup Initrd root Shell mailing-list third-party-advisory
- [oss-security] 20161115 Re: CVE-2016-4484: - Cryptsetup Initrd root Shell - Update: Dracut is also vulnerable mailing-list third-party-advisory
- [oss-security] 20161115 Re: [FD] CVE-2016-4484: - Cryptsetup Initrd root Shell mailing-list third-party-advisory
- [oss-security] 20161116 Re: CVE-2016-4484: - Cryptsetup Initrd root Shell mailing-list third-party-advisory
- 94315 vdb-entry
- gitlab.com patch