CVE-2016-4484

MEDIUM

cryptsetup < 2.1.7.3-2 - Unauthenticated Shell Access via Invalid Password Attempts

Title source: llm
STIX 2.1

Description

The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts with an invalid password.

References (7)

Core 7
Core References
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/11/14/13
Exploit, Mitigation, Technical Description, Third Party Advisory x_refsource_misc
http://hmarco.org/bugs/CVE-2016-4484/CVE-2016-4484_cryptsetup_initrd_shell.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/11/15/1
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/11/15/4
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/94315
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/11/16/6

Scores

CVSS v3 6.8
EPSS 0.0046
EPSS Percentile 64.2%
Attack Vector PHYSICAL
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-287
Status published
Products (1)
cryptsetup_project/cryptsetup < 2.1.7.3-2
Published Jan 23, 2017
Tracked Since Feb 18, 2026