CVE-2016-6340
HighSummary
The kickstart file in Red Hat QuickStart Cloud Installer (QCI) forces the use of MD5 passwords on deployed systems, making it easier for attackers to determine cleartext passwords via a brute-force attack.
Risk Assessment
The use of MD5 passwords increases the risk that attackers can easily crack passwords and gain access to systems, potentially leading to serious security breaches.
Recommendation
It is recommended to update the configuration to use stronger hashing algorithms for passwords, such as SHA-256 or better.
Other vulnerabilities in Red Hat QuickStart Cloud Installer (QCI)
See all- CVE-2016-6322High
Red Hat QuickStart Cloud Installer (QCI) uses world-readable permissions for the /etc/qci/answers file, allowing local users to obtain the root password for the deployed system by reading the file.
- CVE-2016-5411Critical
The engine-DC-config.py script in Red Hat QuickStart Cloud Installer (QCI) before version 1.0 GA is world readable and contains the root password of the deployed system.
Original NVD description (English source)
The kickstart file in Red Hat QuickStart Cloud Installer (QCI) forces use of MD5 passwords on deployed systems, which makes it easier for attackers to determine cleartext passwords via a brute-force attack.