Vulnerabilities > CVE-2004-2394 - Unspecified vulnerability in Mandrakesoft products

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
mandrakesoft
nessus
NVD
Published: 2004-12-31
Updated: 2024-11-20

Summary

Off-by-one error in passwd 0.68 and earlier, when using the --stdin option, causes passwd to use the first 78 characters of a password instead of the first 79, which results in a small reduction of the search space required for brute force attacks.

Vulnerable Configurations

Part Description Count
Application
Mandrakesoft
1
OS
Mandrakesoft
10

Nessus

NASL familyMandriva Local Security Checks
NASL idMANDRAKE_MDKSA-2004-045.NASL
descriptionSteve Grubb found some problems in the passwd program. Passwords given to passwd via stdin are one character shorter than they are supposed to be. He also discovered that pam may not have been sufficiently initialized to ensure safe and proper operation. A few small memory leaks have been fixed as well. The updated packages are patched to correct these problems.
last seen2020-06-01
modified2020-06-02
plugin id14144
published2004-07-31
reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/14144
titleMandrake Linux Security Advisory : passwd (MDKSA-2004:045)

References