CVE-2014-9687
eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it...
eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack.
Exploit likelihood
What each source reports
NVD Score used
eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack.
- Record
CVE-2014-9687- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE List No score
eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack.
- Record
CVE-2014-9687- Updated
- 2026-11-02
EUVDEUVD-2014-9495 No score
eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack.
- Record
EUVD-2014-9495- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mc6q-88m2-653g No score
eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it...
eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack.
- Record
GHSA-mc6q-88m2-653g- Updated
- 2026-11-02
OSV No score
eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack.
- Record
CVE-2014-9687- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9687 No score
eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack.
- Record
DEBIAN-CVE-2014-9687- Updated
- 2026-11-02
Show 5 moreShow less
OSVopenSUSE-SU-2024:10118-1 No score
ecryptfs-utils-108-2.5 on GA media
These are all security issues fixed in the ecryptfs-utils-108-2.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10118-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0241-1 No score
Security update for ecryptfs-utils
This update for ecryptfs-utils fixes the following issues:
- CVE-2016-1572: A local user could have escalated privileges by mounting over special filesystems (bsc#962052)
- CVE-2014-9687: A default salt value reduced complexity of offline precomputation attacks (bsc#920160)
- Record
SUSE-SU-2016:0241-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0290-1 No score
Security update for ecryptfs-utils
This update for ecryptfs-utils fixes the following issues:
- CVE-2016-1572: A local user could have escalated privileges by mounting over special filesystems (bsc#962052)
- CVE-2014-9687: A default salt value reduced complexity of offline precomputation attacks (bsc#920160)
- Record
SUSE-SU-2016:0290-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-9687 No score
eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack.
- Record
UBUNTU-CVE-2014-9687- Updated
- 2026-11-02
OSVUSN-2524-1 No score
ecryptfs-utils vulnerability
Sylvain Pelissier discovered that eCryptfs did not generate a random salt when encrypting the mount passphrase with the login password. An attacker could use this issue to discover the login password used to protect the mount passphrase and gain unintended access to the encrypted files.
- Record
USN-2524-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ecryptfs-utilsDebian:12 |
before 103-4 | 103-4 |
ecryptfs-utilsDebian:13 |
before 103-4 | 103-4 |
ecryptfs-utilsDebian:14 |
before 103-4 | 103-4 |
ecryptfs-utilsSUSE:Linux Enterprise Desktop 12 |
before 103-7.1 | 103-7.1 |
ecryptfs-utilsSUSE:Linux Enterprise Desktop 12 SP1 |
before 103-7.1 | 103-7.1 |
ecryptfs-utilsSUSE:Linux Enterprise Server 12 |
before 103-7.1 | 103-7.1 |
ecryptfs-utilsSUSE:Linux Enterprise Server for SAP Applications 12 |
before 103-7.1 | 103-7.1 |
ecryptfs-utilsSUSE:Linux Enterprise Server 12 SP1 |
before 103-7.1 | 103-7.1 |
ecryptfs-utilsSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 103-7.1 | 103-7.1 |
ecryptfs-utilsSUSE:Linux Enterprise Desktop 11 SP3 |
before 61-1.35.1 | 61-1.35.1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ecryptfs-utilsSUSE:Linux Enterprise Desktop 11 SP4 |
before 61-1.35.1 | 61-1.35.1 |
ecryptfs-utilsSUSE:Linux Enterprise Server 11 SP3 |
before 61-1.35.1 | 61-1.35.1 |
ecryptfs-utilsSUSE:Linux Enterprise Server 11 SP3-TERADATA |
before 61-1.35.1 | 61-1.35.1 |
ecryptfs-utilsSUSE:Linux Enterprise Server for SAP Applications 11 SP3 |
before 61-1.35.1 | 61-1.35.1 |
ecryptfs-utilsSUSE:Linux Enterprise Server 11 SP4 |
before 61-1.35.1 | 61-1.35.1 |
ecryptfs-utilsSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 61-1.35.1 | 61-1.35.1 |
ecryptfs-utilsUbuntu:14.04:LTS |
before 104-0ubuntu1.14.04.3, plus listed versions 103-0ubuntu2104-0ubuntu1 |
104-0ubuntu1.14.04.3 |
ecryptfs-utilsopenSUSE:Tumbleweed |
before 108-2.5 | 108-2.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9687 is a medium vulnerability (CVSS 5.0) in Ecryptfs Ecryptfs-utils, published December 31, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.18%, the 82nd percentile. Fixed in ecryptfs-utils 103-4.
References
lists.opensuse.org/opensuse-updates/2016-01/msg00118.html
openwall.com/lists/oss-security/2015/02/28/3
bugs.launchpad.net/ecryptfs/+bug/906550
ubuntu.com/usn/USN-2524-1
Show 21 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-9687
github.com/advisories/GHSA-mc6q-88m2-653g
security-tracker.debian.org/tracker/CVE-2014-9687
suse.com/support/update/announcement/2016/suse-su-20160241-1
bugzilla.suse.com/920160
ubuntu.com/security/CVE-2014-9687
seclists.org/oss-sec/2015/q1/498
cve.org/CVERecord?id=CVE-2014-9687