Vulnerabilites related to don_libes - expect
Vulnerability from fkie_nvd
Published
2001-04-11 04:00
Modified
2025-04-03 01:03
Severity ?
Summary
mkpasswd in expect 5.2.8, as used by Red Hat Linux 6.2 through 7.0, seeds its random number generator with its process ID, which limits the space of possible seeds and makes it easier for attackers to conduct brute force password attacks.
References
cve@mitre.orghttp://archives.neohapsis.com/archives/bugtraq/2001-04/0173.html
cve@mitre.orghttp://archives.neohapsis.com/archives/bugtraq/2001-04/0192.html
cve@mitre.orghttp://securitytracker.com/id?1001303
cve@mitre.orghttp://www.kb.cert.org/vuls/id/527736US Government Resource
cve@mitre.orghttp://www.securityfocus.com/bid/2632
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/6382
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/bugtraq/2001-04/0173.html
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/bugtraq/2001-04/0192.html
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1001303
af854a3a-2127-422b-91ae-364da2661108http://www.kb.cert.org/vuls/id/527736US Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/2632
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/6382
Impacted products
Vendor Product Version
don_libes expect 5.2.8


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.2.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "F981BF07-D0F3-48D8-88A9-ABD67ACE48E3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "mkpasswd in expect 5.2.8, as used by Red Hat Linux 6.2 through 7.0, seeds its random number generator with its process ID, which limits the space of possible seeds and makes it easier for attackers to conduct brute force password attacks."
    }
  ],
  "id": "CVE-2001-1467",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2001-04-11T04:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2001-04/0173.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2001-04/0192.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1001303"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/527736"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/2632"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6382"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2001-04/0173.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2001-04/0192.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1001303"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/527736"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/2632"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6382"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2001-07-19 04:00
Modified
2025-04-03 01:03
Severity ?
Summary
expect before 5.32 searches for its libraries in /var/tmp before other directories, which could allow local users to gain root privileges via a Trojan horse library that is accessed by mkpasswd.
References
cve@mitre.orghttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000409
cve@mitre.orghttp://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:060
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2002-148.html
cve@mitre.orghttp://www.securityfocus.com/bid/3074Patch, Vendor Advisory
cve@mitre.orghttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=22187
cve@mitre.orghttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=28224
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/6870
af854a3a-2127-422b-91ae-364da2661108http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000409
af854a3a-2127-422b-91ae-364da2661108http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:060
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2002-148.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/3074Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=22187
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=28224
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/6870
Impacted products
Vendor Product Version
don_libes expect 0
don_libes expect 1
don_libes expect 2
don_libes expect 3
don_libes expect 4
don_libes expect 5.0
don_libes expect 5.1
don_libes expect 5.2
don_libes expect 5.3
don_libes expect 5.4
don_libes expect 5.5
don_libes expect 5.6
don_libes expect 5.7
don_libes expect 5.8
don_libes expect 5.9
don_libes expect 5.10
don_libes expect 5.11
don_libes expect 5.12
don_libes expect 5.13
don_libes expect 5.14
don_libes expect 5.15
don_libes expect 5.16
don_libes expect 5.17
don_libes expect 5.18
don_libes expect 5.19
don_libes expect 5.20
don_libes expect 5.21
don_libes expect 5.22
don_libes expect 5.23
don_libes expect 5.24
don_libes expect 5.25
don_libes expect 5.26
don_libes expect 5.27
don_libes expect 5.28
don_libes expect 5.29
don_libes expect 5.30
don_libes expect 5.31
conectiva linux 6.0
conectiva linux 7.0
redhat linux 7.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:don_libes:expect:0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C3DE5021-6C95-42B9-A2F1-2416E1DFFDF8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0B34078-6C72-4160-8C06-CE8DF05F90CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:2:*:*:*:*:*:*:*",
              "matchCriteriaId": "40F92B64-2FC2-494B-80A7-C13799BB0C02",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:3:*:*:*:*:*:*:*",
              "matchCriteriaId": "68CC2FFF-8CA6-4610-82F4-13C91CCBFF18",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:4:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE85170E-C60D-4A51-BFD0-A08E0F16266B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E7522C4-5B5B-49CB-A612-2D3719669EDB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "022D0F6C-2EC7-4193-A3F8-DB9968A453EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "95B5F3CA-557A-4389-B1F1-4DF2598B3DB4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "8AB3F7AB-F00B-424B-9F94-93736B8AC4BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "06C6F995-58CC-405B-A11A-225249131FFA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA9D4278-7E36-4704-9709-9F18DD202459",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "E1BBDD23-C9D2-4EC7-A377-D7CCBE5BFB83",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "29CCE2DF-8B6D-4736-BBE9-87E8D9562542",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BEB2EE9-C619-4E4A-A89A-A035674ED821",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "2959FA2C-08CD-42A9-A5D5-15568F1E570C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC361FE5-B35A-454F-B860-B07E85135764",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "27488026-A7C7-4691-BD8E-4082947D39D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "D61E571C-24E6-48AF-B82E-4ABE258AF422",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "8995324B-665B-435D-9F80-F0A3A7EC5D9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "784F1220-1D89-4AC5-B9FC-F6E53B4997E8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "0ED3433E-5FAD-4643-A000-5830D2841B94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "ACAEE414-0038-457C-9E56-19B1F32E1322",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "D1EDC1A7-8AC3-4329-9574-28F9D62B4BBC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "41697D90-1B8F-4C8E-BDF9-6478F052CC97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.19:*:*:*:*:*:*:*",
              "matchCriteriaId": "F51F3D11-4B37-4E3A-9DA0-A1E5D8D66283",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "74DD6439-CB30-4156-9853-08AD5ECC7B30",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "FB58864B-CEA9-4E1C-A016-23BB377FEE5D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "868C41FB-05DD-4C44-880B-2D88B44787C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.23:*:*:*:*:*:*:*",
              "matchCriteriaId": "965E4608-9A40-4018-91DB-1D3CACF64FDD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.24:*:*:*:*:*:*:*",
              "matchCriteriaId": "378B08A0-001C-4A1F-9D6D-F32CF4483C7B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.25:*:*:*:*:*:*:*",
              "matchCriteriaId": "D6812A69-900D-44A0-8916-1DA12696D72C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.26:*:*:*:*:*:*:*",
              "matchCriteriaId": "EDB1C0AF-8C61-49C4-8F12-EEDE26556B79",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.27:*:*:*:*:*:*:*",
              "matchCriteriaId": "7131D6F4-DD3D-4E51-BE00-CE8A44011B05",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.28:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C29001E-4771-4737-A5FD-DDD14573B361",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.29:*:*:*:*:*:*:*",
              "matchCriteriaId": "B429DFA8-29BA-4F08-BA7D-0A3A5FF1B606",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.30:*:*:*:*:*:*:*",
              "matchCriteriaId": "94C6A9E5-0FF5-4254-ABAD-D784419AF0A7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:don_libes:expect:5.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED82C82B-2227-4C64-A4B0-B597E97E7168",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:conectiva:linux:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DCE4BBA3-7332-45EE-8C29-BE5A473B559D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:conectiva:linux:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "97177EF7-8FC4-4D4D-A8D9-3628AA0035FB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:redhat:linux:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "29B186E5-7C2F-466E-AA4A-8F2B618F8A14",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "expect before 5.32 searches for its libraries in /var/tmp before other directories, which could allow local users to gain root privileges via a Trojan horse library that is accessed by mkpasswd."
    }
  ],
  "id": "CVE-2001-1374",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2001-07-19T04:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000409"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:060"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2002-148.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/3074"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=22187"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=28224"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6870"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000409"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:060"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2002-148.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/3074"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=22187"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=28224"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6870"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2001-1467 (GCVE-0-2001-1467)
Vulnerability from cvelistv5
Published
2005-04-21 04:00
Modified
2024-08-08 04:58
Severity ?
CWE
  • n/a
Summary
mkpasswd in expect 5.2.8, as used by Red Hat Linux 6.2 through 7.0, seeds its random number generator with its process ID, which limits the space of possible seeds and makes it easier for attackers to conduct brute force password attacks.
References
http://archives.neohapsis.com/archives/bugtraq/2001-04/0173.html mailing-list, x_refsource_BUGTRAQ
https://exchange.xforce.ibmcloud.com/vulnerabilities/6382 vdb-entry, x_refsource_XF
http://www.kb.cert.org/vuls/id/527736 third-party-advisory, x_refsource_CERT-VN
http://securitytracker.com/id?1001303 vdb-entry, x_refsource_SECTRACK
http://www.securityfocus.com/bid/2632 vdb-entry, x_refsource_BID
http://archives.neohapsis.com/archives/bugtraq/2001-04/0192.html mailing-list, x_refsource_BUGTRAQ
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T04:58:11.593Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20010411 flaw in RH ``mkpasswd\u0027\u0027 command",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2001-04/0173.html"
          },
          {
            "name": "mkpasswd-weak-passwords(6382)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6382"
          },
          {
            "name": "VU#527736",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/527736"
          },
          {
            "name": "1001303",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1001303"
          },
          {
            "name": "2632",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/2632"
          },
          {
            "name": "20010412 Re: flaw in RH ``mkpasswd\u0027\u0027 command (importance of seeds \u0026 algorithms)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2001-04/0192.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2001-04-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "mkpasswd in expect 5.2.8, as used by Red Hat Linux 6.2 through 7.0, seeds its random number generator with its process ID, which limits the space of possible seeds and makes it easier for attackers to conduct brute force password attacks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-10T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20010411 flaw in RH ``mkpasswd\u0027\u0027 command",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2001-04/0173.html"
        },
        {
          "name": "mkpasswd-weak-passwords(6382)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6382"
        },
        {
          "name": "VU#527736",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/527736"
        },
        {
          "name": "1001303",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1001303"
        },
        {
          "name": "2632",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/2632"
        },
        {
          "name": "20010412 Re: flaw in RH ``mkpasswd\u0027\u0027 command (importance of seeds \u0026 algorithms)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2001-04/0192.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2001-1467",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "mkpasswd in expect 5.2.8, as used by Red Hat Linux 6.2 through 7.0, seeds its random number generator with its process ID, which limits the space of possible seeds and makes it easier for attackers to conduct brute force password attacks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20010411 flaw in RH ``mkpasswd\u0027\u0027 command",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2001-04/0173.html"
            },
            {
              "name": "mkpasswd-weak-passwords(6382)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6382"
            },
            {
              "name": "VU#527736",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/527736"
            },
            {
              "name": "1001303",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1001303"
            },
            {
              "name": "2632",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/2632"
            },
            {
              "name": "20010412 Re: flaw in RH ``mkpasswd\u0027\u0027 command (importance of seeds \u0026 algorithms)",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2001-04/0192.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2001-1467",
    "datePublished": "2005-04-21T04:00:00",
    "dateReserved": "2005-04-21T00:00:00",
    "dateUpdated": "2024-08-08T04:58:11.593Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2001-1374 (GCVE-0-2001-1374)
Vulnerability from cvelistv5
Published
2003-04-02 05:00
Modified
2024-08-08 04:51
Severity ?
CWE
  • n/a
Summary
expect before 5.32 searches for its libraries in /var/tmp before other directories, which could allow local users to gain root privileges via a Trojan horse library that is accessed by mkpasswd.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T04:51:08.224Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "3074",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/3074"
          },
          {
            "name": "MDKSA-2002:060",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRAKE",
              "x_transferred"
            ],
            "url": "http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:060"
          },
          {
            "name": "RHSA-2002:148",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2002-148.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=22187"
          },
          {
            "name": "expect-insecure-library-search(6870)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6870"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=28224"
          },
          {
            "name": "CLA-2001:409",
            "tags": [
              "vendor-advisory",
              "x_refsource_CONECTIVA",
              "x_transferred"
            ],
            "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000409"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2001-07-19T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "expect before 5.32 searches for its libraries in /var/tmp before other directories, which could allow local users to gain root privileges via a Trojan horse library that is accessed by mkpasswd."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2003-03-18T00:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "3074",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/3074"
        },
        {
          "name": "MDKSA-2002:060",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRAKE"
          ],
          "url": "http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:060"
        },
        {
          "name": "RHSA-2002:148",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2002-148.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=22187"
        },
        {
          "name": "expect-insecure-library-search(6870)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6870"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=28224"
        },
        {
          "name": "CLA-2001:409",
          "tags": [
            "vendor-advisory",
            "x_refsource_CONECTIVA"
          ],
          "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000409"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2001-1374",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "expect before 5.32 searches for its libraries in /var/tmp before other directories, which could allow local users to gain root privileges via a Trojan horse library that is accessed by mkpasswd."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "3074",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/3074"
            },
            {
              "name": "MDKSA-2002:060",
              "refsource": "MANDRAKE",
              "url": "http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:060"
            },
            {
              "name": "RHSA-2002:148",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2002-148.html"
            },
            {
              "name": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=22187",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=22187"
            },
            {
              "name": "expect-insecure-library-search(6870)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6870"
            },
            {
              "name": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=28224",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=28224"
            },
            {
              "name": "CLA-2001:409",
              "refsource": "CONECTIVA",
              "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000409"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2001-1374",
    "datePublished": "2003-04-02T05:00:00",
    "dateReserved": "2002-06-07T00:00:00",
    "dateUpdated": "2024-08-08T04:51:08.224Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}