Expect mkpasswd Biased Random Number Generation Vulnerability

Bugtraq ID:	2632
Class:	Design Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Apr 11 2001 12:00AM
Updated:	Apr 11 2001 12:00AM
Credit:	Reported to Bugtraq by Shez <[email protected]> on April 11, 2001.
Vulnerable:	Don Libes Expect 5.2.8 + Redhat Linux 7.0 + Redhat Linux 6.2
Not Vulnerable:

Expect mkpasswd Biased Random Number Generation Vulnerability

The 'mkpasswd' password generation script that ships with expect contains a biased random number generation bug.

The script uses its own random number generator and seeds it with a process id. As a result, only a small set of possible passwords are generated.

Expect mkpasswd Biased Random Number Generation Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Expect mkpasswd Biased Random Number Generation Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Expect mkpasswd Biased Random Number Generation Vulnerability

References: