CVE-2003-0094: Medium severity Andries Brouwer Util-linux vulnerability
A patch for mcookie in the util-linux package for Mandrake Linux 8.2 and 9.0 uses /dev/urandom instead of /dev/random, which causes mcookie to use an entropy source that is more predictable than expected, which may make it easier for certain types of attacks to succeed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure mcookie is configured or patched to use /dev/random as its entropy source instead of /dev/urandom (the referenced patch for mcookie in the util-linux package uses /dev/urandom, which is more predictable).
mcookie (util-linux package) entropy source = /dev/random
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0094?
CVE-2003-0094 is considered a moderate severity vulnerability due to its potential to expose predictable entropy in cryptographic operations.
How do I fix CVE-2003-0094?
To fix CVE-2003-0094, update the util-linux package to a version that does not use /dev/urandom for mcookie.
Who is affected by CVE-2003-0094?
CVE-2003-0094 affects users of Mandrake Linux versions 8.2 and 9.0 that utilize the vulnerable versions of the util-linux package.
What type of attacks can CVE-2003-0094 facilitate?
CVE-2003-0094 may facilitate attacks that rely on predictable random number generation, impacting cryptographic security.
When was CVE-2003-0094 published?
CVE-2003-0094 was published on January 9, 2003.