CVE-2013-2120: 
Linux Debian vulnerability analysis and mitigation

CVE-2013-2120 affects the KDE Paste Applet's password generation functionality in kdeplasma-addons versions before 4.10.5. The vulnerability lies in the %{password(...)} macro within pastemacroexpander.cpp, which fails to properly generate secure passwords (NVD, CVE).

The vulnerability stems from weak random number generation in the password generation function. The code used QDateTime::currentDateTime() and qsrand() with a predictable seed value, making the generated passwords susceptible to brute-force attacks. The CVSS v3.1 base score is 8.4 (High) with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD, OSS Security).

The vulnerability allows context-dependent attackers to bypass authentication through brute-force attacks due to the predictable nature of the generated passwords. The weak random number generation significantly reduces the effective password entropy, making it feasible to determine the generated passwords (NVD).

A patch was released that switched to using KRandom and addressed modulo bias issues. However, it was noted that the fix still had limitations as KRandom is based on rand() with only 2^32 possible seeds. Users can work around the issue by using the %{exec(...)} macro to call a secure password generator instead (Red Hat Bugzilla, KDE Commit).