Unscored severity · published Mar 16, 2015
CVE-2014-9687
eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack
–
CVSS
2.2%
EPSS
No
On KEV
Description
eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
Ecryptfs-utils · Ecryptfs
through 104 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-9687
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-9687
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2016-01/msg00118.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/02/10/16
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/02/17/7
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/02/28/3
Vendor Advisory
http://www.ubuntu.com/usn/USN-2524-1
Exploit
https://bugs.launchpad.net/ecryptfs/+bug/906550
More from Ecryptfs-utils
8.4
CVE-2016-1572
mount.ecryptfs_private.c in eCryptfs-utils does not validate mount destination filesystem types, which allows local users to gain privileges by mounting over a nonstandard…
7.8
CVE-2012-3409
ecryptfs-utils: suid helper does not restrict mounting filesystems with nosuid,nodev which creates a possible privilege escalation
3.3
CVE-2016-6224
ecryptfs-setup-swap in eCryptfs does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning on a (1) NVMe or (2) MMC drive, which…
3.3
CVE-2015-8946
ecryptfs-setup-swap in eCryptfs before 111 does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning and certain versions of systemd,…
–
CVE-2011-1837
The lock-counter implementation in utils/mount.ecryptfs_private.c in ecryptfs-utils before 90 allows local users to overwrite arbitrary files via unspecified vectors