CCE-94468-6| Platform: cpe:/o:oracle:linux:8, cpe:/o:redhat:enterprise_linux:8, cpe:/o:redhat:enterprise_linux:9 | Date: (C)2019-11-07 (M)2023-07-04 |
The pam_pwquality module's 'difok' parameter controls requirements for usage of different
characters during a password change. Modify the 'difok' setting in '/etc/security/pwquality.conf'
to require differing characters when changing passwords. The DoD requirement is '4'.
Parameter:
[4_diff_char]
Technical Mechanism:
Requiring a minimum number of different characters during password changes ensures that
newly changed passwords should not resemble previously compromised ones.
Note that passwords which are changed on compromised systems will still be compromised, however.
| CCSS Severity: | CCSS Metrics: |
| CCSS Score : 8.1 | Attack Vector: NETWORK |
| Exploit Score: 2.2 | Attack Complexity: HIGH |
| Impact Score: 5.9 | Privileges Required: NONE |
| Severity: HIGH | User Interaction: NONE |
| Vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | Scope: UNCHANGED |
| | Confidentiality: HIGH |
| | Integrity: HIGH |
| | Availability: HIGH |
| | |
References: | Resource Id | Reference |
|---|
| SCAP Repo OVAL Definition | oval:org.secpod.oval:def:72262 |
| SCAP Repo OVAL Definition | oval:org.secpod.oval:def:84136 |
| SCAP Repo OVAL Definition | oval:org.secpod.oval:def:55858 |
