CVE-2000-0118: High severity Sun SunOS vulnerability
The Red Hat Linux su program does not log failed password guesses if the su process is killed before it times out, which allows local attackers to conduct brute force password guessing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the su program or the system authentication/logging subsystem so that failed password guesses are recorded immediately (i.e., ensure logging of failed su authentication occurs even if the su process is killed before it times out).
Red Hat Linux su program authentication logging behavior = log failed password attempts immediately - Compensating control
Restrict local interactive access to trusted accounts and hosts to reduce risk of local brute-force attacks (for example, limit who can run su, restrict console/physical access, and monitor for repeated authentication failures).
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0118?
CVE-2000-0118 is considered a moderate severity vulnerability due to its potential for local attackers to conduct brute force attacks without being logged.
How do I fix CVE-2000-0118?
To fix CVE-2000-0118, users should update their Red Hat Linux environment to a version that addresses this vulnerability.
Which versions of Red Hat Linux are affected by CVE-2000-0118?
CVE-2000-0118 affects Red Hat Linux versions 2.0 through 6.1.
What kind of attacks does CVE-2000-0118 enable?
CVE-2000-0118 enables local attackers to perform brute force password guessing attacks without the risk of being logged.
Is CVE-2000-0118 applicable to Solaris systems?
CVE-2000-0118 is primarily associated with Red Hat Linux and does not specifically apply to Solaris systems.