• CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
The Red Hat Linux su program does not log failed password guesses if the su process is killed before it times out, which allows local attackers to conduct brute force password guessing.
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
Assigning CNA
MITRE Corporation
Date Record Created
20000208 Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Proposed (20000208)
Votes (Legacy)
ACCEPT(3) Baker, Cole, Levy
MODIFY(1) Frech
NOOP(1) Wall
REVIEWING(1) Christey
Comments (Legacy)
 Frech> Is this the same issue as BugTraq Mailing List, Wed, 9 Jun 1999 14:07:27
   -0700 "vulnerability in su/PAM in redhat" at and
   "Solaris 2.5 /bin/su [was: vulnerability in su/PAM in redhat]" at
   If so, then MODIFY XF:su-brute
 Christey> BID:320
 CHANGE> [Frech changed vote from REVIEWING to MODIFY]
 Frech> XF:su-brute(2278)
   This issue involves more platforms than Red Hat. See BugTraq
   Mailing List, Thu Jun 10 1999 12:13:06, "Solaris 2.5 /bin/su [was:
   vulnerability in su/PAM in redhat]",
 Christey> It does look like this is the same issue as the other Bugtraq
   post that explicitly mentions Red Hat and PAM.
 CHANGE> [Christey changed vote from NOOP to REVIEWING]

Proposed (Legacy)
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.