CVE-2004-2394: Low severity Mandrakesoft Mandrake Multi Network Firewall vulnerability
Off-by-one error in passwd 0.68 and earlier, when using the --stdin option, causes passwd to use the first 78 characters of a password instead of the first 79, which results in a small reduction of the search space required for brute force attacks.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2004-2394?
CVE-2004-2394 has a low severity due to the minimal reduction in brute force search space.
How do I fix CVE-2004-2394?
To fix CVE-2004-2394, upgrade to a version of the passwd utility that is not affected, preferably beyond version 0.68.
Which software is affected by CVE-2004-2394?
CVE-2004-2394 affects several distributions of Mandrake Linux and Mandriva Linux, including versions 8.2, 9.0, 9.1, 9.2, and 10.0.
What is the impact of CVE-2004-2394?
The impact of CVE-2004-2394 is primarily a slight increase in vulnerability to brute force password attacks due to an off-by-one error.
Is CVE-2004-2394 still a threat today?
CVE-2004-2394 is considered outdated and primarily affects legacy systems that still use the vulnerable versions of passwd.