Vulnerability CVE-2000-0118 - CERT Civis.Net

Vulnerability Name:

CVE-2000-0118 (CCN-2278)

Assigned:

1999-06-09

Published:

1999-06-09

Updated:

2018-10-30

Summary:

The Red Hat Linux su program does not log failed password guesses if the su process is killed before it times out, which allows local attackers to conduct brute force password guessing.

CVSS v3 Severity:

9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2000-0118

Source: BUGTRAQ
Type: UNKNOWN
20000130 RedHat 6.1 /and others/ PAM

Source: CCN
Type: BugTraq Mailing List, 1999-06-09 21:07:27
vulnerability in su/PAM in redhat

Source: CCN
Type: BugTraq Mailing List, 1999-06-10 19:13:06
Solaris 2.5 /bin/su [was: vulnerability in su/PAM in redhat]

Source: CCN
Type: OSVDB ID: 13635
Red Hat Linux su Failed Password Logging Weakness

Source: CCN
Type: BID-320
RedHat su No Logging Vulnerability

Source: XF
Type: UNKNOWN
su-brute(2278)

Vulnerable Configuration:

Configuration 1:

cpe:/o:redhat:linux:2.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:2.1:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:3.0.3:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:4.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:4.1:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:4.2:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:5.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:5.1:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:5.2:*:alpha:*:*:*:*:*

OR cpe:/o:redhat:linux:5.2:*:i386:*:*:*:*:*

OR cpe:/o:redhat:linux:5.2:*:sparc:*:*:*:*:*

OR cpe:/o:redhat:linux:6.0:*:alpha:*:*:*:*:*

OR cpe:/o:redhat:linux:6.0:*:i386:*:*:*:*:*

OR cpe:/o:redhat:linux:6.0:*:sparc:*:*:*:*:*

OR cpe:/o:redhat:linux:6.1:*:alpha:*:*:*:*:*

OR cpe:/o:redhat:linux:6.1:*:i386:*:*:*:*:*

OR cpe:/o:redhat:linux:6.1:*:sparc:*:*:*:*:*

OR cpe:/o:sun:solaris:*:*:x86:*:*:*:*:*

OR cpe:/o:sun:solaris:1.1.3:u1:*:*:*:*:*:*

OR cpe:/o:sun:solaris:1.1.4:*:jl:*:*:*:*:*

OR cpe:/o:sun:solaris:2.4:*:x86:*:*:*:*:*

OR cpe:/o:sun:sunos:-:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:4.1.3:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:4.1.4:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:5.0:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:5.1:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:5.2:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:5.3:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:5.4:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:5.5:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/o:linux:linux_kernel:*:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:5.3:*:*:*:*:*:*:*

OR cpe:/o:sun:solaris:2.5:*:x86:*:*:*:*:*

OR cpe:/o:sun:solaris:2.4:*:x86:*:*:*:*:*

OR cpe:/o:sun:sunos:5.2:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:5.2:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:6.0:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:4.1.1:*:*:*:*:*:*:*

Denotes that component is vulnerable