QwikSec

Security Database

CVE

CWE

Training

CVE-2006-0591

Published: Feb 8, 2006

Modified: Aug 7, 2024

PUBLISHED

Description

The crypt_gensalt functions for BSDI-style extended DES-based and FreeBSD-sytle MD5-based password hashes in crypt_blowfish 0.4.7 and earlier do not evenly and randomly distribute salts, which makes it easier for attackers to guess passwords from a stolen password file due to the increased number of collisions.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

20060207 crypt_blowfish 1.0

mailing-list

x_refsource_BUGTRAQ

third-party-advisory

x_refsource_SECUNIA

cryptblowfish-salt-information-disclosure(24590)

vdb-entry

x_refsource_XF

third-party-advisory

x_refsource_SECUNIA

vendor-advisory

x_refsource_REDHAT

third-party-advisory

x_refsource_SECUNIA

vdb-entry

x_refsource_OSVDB

third-party-advisory

x_refsource_SECUNIA

vdb-entry

x_refsource_VUPEN

http://support.avaya.com/elmodocs2/security/ASA-2006-113.htm

x_refsource_CONFIRM

oval:org.mitre.oval:def:11502

vdb-entry

signature

x_refsource_OVAL

http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/glibc/crypt_blowfish/crypt_gensalt.c?only_with_tag=CRYPT_BLOWFISH_1_0

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.