CVE-2008-3188 : libxcrypt in SUSE openSUSE 11.0 uses the DES algorithm when the configuration sp

libxcrypt in SUSE openSUSE 11.0 uses the DES algorithm when the configuration specifies the MD5 algorithm, which makes it easier for attackers to conduct brute-force attacks against hashed passwords.

Published 2008-07-22 16:41:00

Updated 2024-02-09 03:19:49

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2008-3188

Opensuse » Opensuse » Version: 11.0
cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2008-3188

EPSS FAQ

0.47%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 76 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2008-3188

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST	2024-02-09
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2008-3188

CWE-326 Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Assigned by: nvd@nist.gov (Primary)
CWE-327 Use of a Broken or Risky Cryptographic Algorithm

The product uses a broken or risky cryptographic algorithm or protocol.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2008-3188

http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00008.html

[security-announce] SUSE Security Announcement: libxcrypt (SUSE-SA:2008:036) - openSUSE Security Announce - openSUSE Mailing Lists
Mailing List;Vendor Advisory
http://secunia.com/advisories/31096

About Secunia Research | Flexera
Broken Link;Third Party Advisory
http://www.securityfocus.com/bid/30301

Broken Link;Third Party Advisory;VDB Entry
http://secunia.com/advisories/31339

About Secunia Research | Flexera
Broken Link;Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/43927

OpenSUSE libxcrypt weak security CVE-2008-3188 Vulnerability Report
Third Party Advisory;VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00001.html

[security-announce] SUSE Security Summary Report: SUSE-SR:2008:016 - openSUSE Security Announce - openSUSE Mailing Lists
Mailing List;Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2008-3188

Products affected by CVE-2008-3188

Exploit prediction scoring system (EPSS) score for CVE-2008-3188

CVSS scores for CVE-2008-3188

CWE ids for CVE-2008-3188

References for CVE-2008-3188