Lucene search
HistoryOct 07, 2011 - 2:51 a.m.
CVE-2011-2190
CVSS2
2.1
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
AI Score
6
Confidence
Low
EPSS
0
Percentile
5.1%
The generate_admin_password function in Cherokee before 1.2.99 uses time and PID values for seeding of a random number generator, which makes it easier for local users to determine admin passwords via a brute-force attack.
Affected configurations
Node
cherokee-projectcherokeeRange≤1.2.98
ORcherokee-projectcherokeeMatch0.3.0
ORcherokee-projectcherokeeMatch0.4.0
ORcherokee-projectcherokeeMatch0.4.1
ORcherokee-projectcherokeeMatch0.4.2
ORcherokee-projectcherokeeMatch0.4.3
ORcherokee-projectcherokeeMatch0.4.4
ORcherokee-projectcherokeeMatch0.4.5
ORcherokee-projectcherokeeMatch0.4.6
ORcherokee-projectcherokeeMatch0.4.7
ORcherokee-projectcherokeeMatch0.4.8
ORcherokee-projectcherokeeMatch0.4.9
ORcherokee-projectcherokeeMatch0.4.10
ORcherokee-projectcherokeeMatch0.4.11
ORcherokee-projectcherokeeMatch0.4.12
ORcherokee-projectcherokeeMatch0.4.13
ORcherokee-projectcherokeeMatch0.4.14
ORcherokee-projectcherokeeMatch0.4.15
ORcherokee-projectcherokeeMatch0.4.16
ORcherokee-projectcherokeeMatch0.4.17
ORcherokee-projectcherokeeMatch0.4.18
ORcherokee-projectcherokeeMatch0.4.19
ORcherokee-projectcherokeeMatch0.4.20
ORcherokee-projectcherokeeMatch0.4.21
ORcherokee-projectcherokeeMatch0.4.22
ORcherokee-projectcherokeeMatch0.4.23
ORcherokee-projectcherokeeMatch0.4.24
ORcherokee-projectcherokeeMatch0.4.25
ORcherokee-projectcherokeeMatch0.4.26
ORcherokee-projectcherokeeMatch0.4.27
ORcherokee-projectcherokeeMatch0.4.28
ORcherokee-projectcherokeeMatch0.4.29
ORcherokee-projectcherokeeMatch0.4.30
ORcherokee-projectcherokeeMatch0.5.0
ORcherokee-projectcherokeeMatch0.5.1
ORcherokee-projectcherokeeMatch0.5.2
ORcherokee-projectcherokeeMatch0.5.3
ORcherokee-projectcherokeeMatch0.5.4
ORcherokee-projectcherokeeMatch0.5.5
ORcherokee-projectcherokeeMatch0.5.6
ORcherokee-projectcherokeeMatch0.6.0
ORcherokee-projectcherokeeMatch0.6.1
ORcherokee-projectcherokeeMatch0.7.0
ORcherokee-projectcherokeeMatch0.7.1
ORcherokee-projectcherokeeMatch0.7.2
ORcherokee-projectcherokeeMatch0.8.0
ORcherokee-projectcherokeeMatch0.8.1
ORcherokee-projectcherokeeMatch0.9.0
ORcherokee-projectcherokeeMatch0.9.1
ORcherokee-projectcherokeeMatch0.9.2
ORcherokee-projectcherokeeMatch0.9.3
ORcherokee-projectcherokeeMatch0.9.4
ORcherokee-projectcherokeeMatch0.10.0
ORcherokee-projectcherokeeMatch0.10.1
ORcherokee-projectcherokeeMatch0.11.0
ORcherokee-projectcherokeeMatch0.11.1
ORcherokee-projectcherokeeMatch0.11.2
ORcherokee-projectcherokeeMatch0.11.3
ORcherokee-projectcherokeeMatch0.11.4
ORcherokee-projectcherokeeMatch0.11.5
ORcherokee-projectcherokeeMatch0.11.6
ORcherokee-projectcherokeeMatch0.98.0
ORcherokee-projectcherokeeMatch0.98.1
ORcherokee-projectcherokeeMatch0.99.0
ORcherokee-projectcherokeeMatch0.99.1
ORcherokee-projectcherokeeMatch0.99.2
ORcherokee-projectcherokeeMatch0.99.3
ORcherokee-projectcherokeeMatch0.99.4
ORcherokee-projectcherokeeMatch0.99.5
ORcherokee-projectcherokeeMatch0.99.6
ORcherokee-projectcherokeeMatch0.99.07
ORcherokee-projectcherokeeMatch0.99.8
ORcherokee-projectcherokeeMatch0.99.9
ORcherokee-projectcherokeeMatch0.99.10
ORcherokee-projectcherokeeMatch0.99.11
ORcherokee-projectcherokeeMatch0.99.12
ORcherokee-projectcherokeeMatch0.99.13
ORcherokee-projectcherokeeMatch0.99.14
ORcherokee-projectcherokeeMatch0.99.15
ORcherokee-projectcherokeeMatch0.99.16
ORcherokee-projectcherokeeMatch0.99.17
ORcherokee-projectcherokeeMatch0.99.18
ORcherokee-projectcherokeeMatch0.99.19
ORcherokee-projectcherokeeMatch0.99.20
ORcherokee-projectcherokeeMatch0.99.21
ORcherokee-projectcherokeeMatch0.99.22
ORcherokee-projectcherokeeMatch0.99.23
ORcherokee-projectcherokeeMatch0.99.24
ORcherokee-projectcherokeeMatch0.99.25
ORcherokee-projectcherokeeMatch0.99.26
ORcherokee-projectcherokeeMatch0.99.27
ORcherokee-projectcherokeeMatch0.99.28
ORcherokee-projectcherokeeMatch0.99.29
ORcherokee-projectcherokeeMatch0.99.30
ORcherokee-projectcherokeeMatch0.99.31
ORcherokee-projectcherokeeMatch0.99.32
ORcherokee-projectcherokeeMatch0.99.33
ORcherokee-projectcherokeeMatch0.99.34
ORcherokee-projectcherokeeMatch0.99.35
ORcherokee-projectcherokeeMatch0.99.36
ORcherokee-projectcherokeeMatch0.99.37
ORcherokee-projectcherokeeMatch0.99.38
ORcherokee-projectcherokeeMatch0.99.39
ORcherokee-projectcherokeeMatch0.99.40
ORcherokee-projectcherokeeMatch0.99.41
ORcherokee-projectcherokeeMatch0.99.42
ORcherokee-projectcherokeeMatch0.99.43
ORcherokee-projectcherokeeMatch0.99.44
ORcherokee-projectcherokeeMatch0.99.45
ORcherokee-projectcherokeeMatch0.99.46
ORcherokee-projectcherokeeMatch0.99.47
ORcherokee-projectcherokeeMatch0.99.48
ORcherokee-projectcherokeeMatch0.99.49
ORcherokee-projectcherokeeMatch1.0.0
ORcherokee-projectcherokeeMatch1.0.1
ORcherokee-projectcherokeeMatch1.0.2
ORcherokee-projectcherokeeMatch1.0.3
ORcherokee-projectcherokeeMatch1.0.4
ORcherokee-projectcherokeeMatch1.0.5
ORcherokee-projectcherokeeMatch1.0.6
ORcherokee-projectcherokeeMatch1.0.7
ORcherokee-projectcherokeeMatch1.0.8
ORcherokee-projectcherokeeMatch1.0.9
ORcherokee-projectcherokeeMatch1.0.10
ORcherokee-projectcherokeeMatch1.0.11
ORcherokee-projectcherokeeMatch1.0.12
ORcherokee-projectcherokeeMatch1.0.13
ORcherokee-projectcherokeeMatch1.0.14
ORcherokee-projectcherokeeMatch1.0.15
ORcherokee-projectcherokeeMatch1.0.16
ORcherokee-projectcherokeeMatch1.0.17
ORcherokee-projectcherokeeMatch1.0.18
ORcherokee-projectcherokeeMatch1.0.19
ORcherokee-projectcherokeeMatch1.0.20
ORcherokee-projectcherokeeMatch1.2.0
ORcherokee-projectcherokeeMatch1.2.1
ORcherokee-projectcherokeeMatch1.2.2
| Vendor | Product | Version | CPE |
|---|---|---|---|
| cherokee-project | cherokee | * | cpe:2.3:a:cherokee-project:cherokee:*:*:*:*:*:*:*:* |
| cherokee-project | cherokee | 0.3.0 | cpe:2.3:a:cherokee-project:cherokee:0.3.0:*:*:*:*:*:*:* |
| cherokee-project | cherokee | 0.4.0 | cpe:2.3:a:cherokee-project:cherokee:0.4.0:*:*:*:*:*:*:* |
| cherokee-project | cherokee | 0.4.1 | cpe:2.3:a:cherokee-project:cherokee:0.4.1:*:*:*:*:*:*:* |
| cherokee-project | cherokee | 0.4.2 | cpe:2.3:a:cherokee-project:cherokee:0.4.2:*:*:*:*:*:*:* |
| cherokee-project | cherokee | 0.4.3 | cpe:2.3:a:cherokee-project:cherokee:0.4.3:*:*:*:*:*:*:* |
| cherokee-project | cherokee | 0.4.4 | cpe:2.3:a:cherokee-project:cherokee:0.4.4:*:*:*:*:*:*:* |
| cherokee-project | cherokee | 0.4.5 | cpe:2.3:a:cherokee-project:cherokee:0.4.5:*:*:*:*:*:*:* |
| cherokee-project | cherokee | 0.4.6 | cpe:2.3:a:cherokee-project:cherokee:0.4.6:*:*:*:*:*:*:* |
| cherokee-project | cherokee | 0.4.7 | cpe:2.3:a:cherokee-project:cherokee:0.4.7:*:*:*:*:*:*:* |
References
code.google.com/p/cherokee/issues/detail?id=1212
lists.fedoraproject.org/pipermail/package-announce/2011-September/066222.html
www.cherokee-project.com/download/LATEST_is_1.2.99/cherokee-1.2.99.tar.gz
www.openwall.com/lists/oss-security/2011/06/03/4
www.openwall.com/lists/oss-security/2011/06/06/21
www.securityfocus.com/bid/49772
bugzilla.redhat.com/show_bug.cgi?id=713304
Related
prion
prion
Design/Logic Flaw
2011-10-07 02:51:00
ubuntucve
ubuntucve
CVE-2011-2190
2011-10-07 00:00:00
cvelist
cvelist
CVE-2011-2190
2011-10-07 01:00:00
cve
cve
CVE-2011-2190
2011-10-07 02:51:40
openvas
openvas
Fedora Update for cherokee FEDORA-2011-14634
2011-11-25 00:00:00
Fedora Update for cherokee FEDORA-2011-14622
2012-04-02 00:00:00
Fedora Update for cherokee FEDORA-2011-12687
2011-09-27 00:00:00
nessus
nessus
Fedora 16 : cherokee-1.2.99-1.fc16 (2011-12657)
2011-10-03 00:00:00
Fedora 16 : cherokee-1.2.101-1.fc16 (2011-14622)
2011-11-26 00:00:00
Fedora 15 : cherokee-1.2.101-1.fc15 (2011-14634)
2011-11-26 00:00:00
fedora
fedora
[SECURITY] Fedora 14 Update: cherokee-1.2.101-1.fc14
2011-11-25 01:54:42
[SECURITY] Fedora 16 Update: cherokee-1.2.101-1.fc16
2011-11-25 01:53:52
[SECURITY] Fedora 15 Update: cherokee-1.2.99-1.fc15
2011-09-25 03:35:58
CVSS2
2.1
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
AI Score
6
Confidence
Low
EPSS
0
Percentile
5.1%
Related for NVD:CVE-2011-2190