PT-2003-1362 · Linux · Util-Linux

Publicado 2003-03-03 · Atualizado 2017-10-10 · CVE-2003-0094

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions util-linux package versions 8.2 through 9.0

Description The issue is related to the mcookie utility in the util-linux package, which uses /dev/urandom instead of /dev/random. This causes mcookie to use a more predictable entropy source, potentially making certain types of attacks easier to succeed.

Recommendations For util-linux package versions 8.2 through 9.0, consider applying a patch that changes mcookie to use /dev/random instead of /dev/urandom to improve entropy source unpredictability.

Correção

Identificadores relacionados

CVE-2003-0094

Produtos afetados

Util-Linux

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2003-0094 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11318 · Nota
• http://mandrakesoft.com/security/advisories?name=MDKSA-2003:016 · Aviso do Fabricante
• http://securityfocus.com/bid/6855 · Nota