Red Hat Enterprise Linux8 update for the idm:DL1 module



| Updated: 2024-08-23
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2024-3183
CWE-ID CWE-916
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
 Red Hat Enterprise Linux Server - AUS
Operating systems & Components / Operating system

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Use of Password Hash With Insufficient Computational Effort

EUVDB-ID: #VU92249

Risk: Low

CVSSv4.0: 2.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2024-3183

CWE-ID: CWE-916 - Use of Password Hash With Insufficient Computational Effort

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to software uses principal key to encrypt tickets. A remote attacker can brute-force the principal key and decrypt communication between KDC and the client.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux Server - AUS: 8.2

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2024:3758


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###