Advisory: jBCrypt < 0.3 character encoding vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 jBCrypt security advisory ========================= jBCrypt is a Java implementation of OpenBSD's Blowfish password hashing algorithm, as described in "A Future-Adaptable Password Scheme" by Niels Provos and David Mazieres USENIX, 1999. Versions of...

CVE-2009-4304

Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not use a random password salt in config.php, which makes it easier for attackers to conduct brute-force password guessing attacks...

Nate Lawson: Crypto Strikes Back!

This Google Tech Talk features researcher Nate Lawson discussing recent vulnerabilities in crypto libraries, why public key cryptography is like a Ford Pinto in a demolition derby and the password-hashing mess created by Web 2.0 sites...

DEBIAN-CVE-2008-6792

system-tools-backends before 2.6.0-1ubuntu1.1 in Ubuntu 8.10, as used by "Users and Groups" in GNOME System Tools, hashes account passwords with 3DES and consequently limits effective password lengths to eight characters, which makes it easier for context-dependent attackers to successfully condu...

CVE-2008-6792: Undefined Security Weakness

system-tools-backends before 2.6.0-1ubuntu1.1 in Ubuntu 8.10, as used by "Users and Groups" in GNOME System Tools, hashes account passwords with 3DES and consequently limits effective password lengths to eight characters, which makes it easier for context-dependent attackers to successfully condu...

Ubuntu 8.10 : system-tools-backends regression (USN-663-1)

It was discovered that passwords changed or new users created via the 'Users and Groups' tool were created with 3DES hashing. This reduced the security of stored user passwords, and was a regression from the correct MD5 hashing. This update fixes the problem; future password changes will correct...

SuSE Update for libxcrypt SUSE-SA:2008:036

Check for the Version of libxcrypt OpenVAS Vulnerability Test $Id: gbsuse2008036.nasl 8050 2017-12-08 09:34:29Z santu $ SuSE Update for libxcrypt SUSE-SA:2008:036 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free...

CVE-2008-4905

Typo 5.1.3 and earlier uses a hard-coded salt for calculating password hashes, which makes it easier for attackers to guess passwords via a brute force attack...

CVE-2008-3188

libxcrypt in SUSE openSUSE 11.0 uses the DES algorithm when the configuration specifies the MD5 algorithm, which makes it easier for attackers to conduct brute-force attacks against hashed passwords...

CVE-2008-3188

libxcrypt in SUSE openSUSE 11.0 uses the DES algorithm when the configuration specifies the MD5 algorithm, which makes it easier for attackers to conduct brute-force attacks against hashed passwords...

PT-2008-4605 · Suse · Opensuse

Name of the Vulnerable Software and Affected Versions: SUSE openSUSE version 11.0 Description: The issue makes it easier for attackers to conduct brute-force attacks against hashed passwords due to the use of the DES algorithm when the configuration specifies the MD5 algorithm. Recommendations: F...

CVE-2008-1526

ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40PE9 and 3.40AGD.2 through 3.40AHQ.3, do not use a salt when calculating an MD5 password hash, which makes it easier for attackers to crack passwords...

CVE-2008-1526

ZyXEL Prestige routers P-660, P-661, and P-662 with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3) compute MD5 password hashes without a salt, making passwords easier to crack. Affected components are the router firmware password hashing. The exploitation details are not provided in the d...

CVE-2003-1480

MySQL 3.20 through 4.1.0 uses a weak algorithm for hashed passwords, which makes it easier for attackers to decrypt the password via brute force methods...

CVE-2003-1480

Summary: CVE-2003-1480 concerns Oracle/MySQL Server versions 3.20–4.1.0 that use a weak password-hashing algorithm. The root cause is the weak hashing scheme used for passwords stored in mysql.user, which can allow an attacker who can read the table to brute-force and recover plaintext passwords....

CVE-2003-1480: Undefined Security Weakness

MySQL 3.20 through 4.1.0 uses a weak algorithm for hashed passwords, which makes it easier for attackers to decrypt the password via brute force methods...

Authentication flaw

Rule Set Based Access Control RSBAC before 1.3.5 does not properly use the Linux Kernel Crypto API for the Linux kernel 2.6.x, which allows context-dependent attackers to bypass authentication controls via unspecified vectors, possibly involving User Management password hashing and unchecked...

CVE-2007-3945

Rule Set Based Access Control RSBAC before 1.3.5 does not properly use the Linux Kernel Crypto API for the Linux kernel 2.6.x, which allows context-dependent attackers to bypass authentication controls via unspecified vectors, possibly involving User Management password hashing and unchecked...

CVE-2007-3945: Undefined Security Weakness

Rule Set Based Access Control RSBAC before 1.3.5 does not properly use the Linux Kernel Crypto API for the Linux kernel 2.6.x, which allows context-dependent attackers to bypass authentication controls via unspecified vectors, possibly involving User Management password hashing and unchecked...

security flaw

BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables...