CVE-2001-1467: High severity Don Libes Expect vulnerability

Published Apr 11, 2001

Updated

mkpasswd in expect 5.2.8, as used by Red Hat Linux 6.2 through 7.0, seeds its random number generator with its process ID, which limits the space of possible seeds and makes it easier for attackers to conduct brute force password attacks.

Affected Software

1 affected component

Don Libes Expect=5.2.8

Event History

Apr 11, 2001

CVE Published

04:00 AM

Apr 21, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2001-1467?

CVE-2001-1467 is classified as a medium severity vulnerability due to its potential to facilitate brute force password attacks.

How does CVE-2001-1467 affect mkpasswd in expect 5.2.8?

CVE-2001-1467 affects mkpasswd in expect 5.2.8 by seeding its random number generator with its process ID, reducing randomness in password generation.

How can I mitigate the risks associated with CVE-2001-1467?

Mitigation for CVE-2001-1467 can be achieved by using a version of expect that is newer than 5.2.8 which avoids this vulnerability.

What versions of Red Hat Linux are affected by CVE-2001-1467?

Red Hat Linux versions 6.2 through 7.0 are affected by CVE-2001-1467.

What is the recommended action for users of expect 5.2.8 regarding CVE-2001-1467?

Users of expect 5.2.8 are recommended to upgrade to a secure version to eliminate the vulnerabilities associated with CVE-2001-1467.