Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

su program on Red Hat Linux may hide failed attempts

CVE-2000-0118 · published 27 years ago
Summary

The su command on Red Hat Linux (and similar Unix systems) can fail to record password guesses when the su process is stopped before it times out. This lets someone with local access try many passwords without leaving a log, making brute‑force attacks harder to detect. Apply the latest security updates from your vendor and consider using tools that enforce logging or alternative privilege escalation methods.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
redhat linux 2.0
2.1
3.0.3
4.0
4.1
4.2
5.0
5.1
5.2
6.0
6.1
cpe:2.3:o:redhat:linux:2.0:*:*:*:*:*:*:*
sun solaris 1.1.3
1.1.4
2.4
cpe:2.3:o:sun:solaris:*:*:x86:*:*:*:*:*
sun sunos 4.1.3
4.1.4
5.0
5.1
5.2
5.3
5.4
5.5
cpe:2.3:o:sun:sunos:-:*:*:*:*:*:*:*
Original advisory text
The Red Hat Linux su program does not log failed password guesses if the su process is killed before it times out, which allows local attackers to conduct brute force password guessing.
The Red Hat Linux su program does not log failed password guesses if the su process is killed before it times out, which allows local attackers to conduct brute force password guessing.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.2 High
Exploitation
<1% chance of attack within 30 days
Timeline
Published9 Jun 1999
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2000-0118 · NVD
Track software like this
Free during beta