SuSE 10 Security Update : glibc (ZYPP Patch Number 7659)

The implementation of the blowfish based password hashing method had a bug affecting passwords that contain 8bit characters e.g. umlauts. Affected passwords are potentially faster to crack via brute-force methods. CVE-2011-2483 SUSE's crypt implementation supports the blowfish password hashing...

SuSE9 Security Update : glibc suite (YOU Patch Number 12813)

The implementation of the blowfish based password hashing method had a bug affecting passwords that contain 8bit characters e.g. umlauts. Affected passwords are potentially faster to crack via brute-force methods. CVE-2011-2483 SUSE's crypt implementation supports the blowfish password hashing...

SA-CONTRIB-2011-026 - Secure Password Hashes (phpass) - Multiple Vulnerabilities

This module uses the PHPass hashing library to try to store users hashed passwords securely. The module sets a fixed string for the 'pass' column in the users database column but does not replace the pass attribute of the account object used for password reset links. This leads to a vulnerability...

Fedora 14 : pure-ftpd-1.0.32-1.fc14 (2011-7374)

Updating to current 1.0.32 version. - added support SHA1 password hashing in MySQL and PostgreSQL backends - removed support for braces expansion in directory listings has been disabled CVE-2011-0418 - list of allowed ciphers for SSL/TLS connections can be specified Note that Tenable Network...

Fedora 15 : pure-ftpd-1.0.32-1.fc15 (2011-7434)

Updating to current 1.0.32 version. - added support SHA1 password hashing in MySQL and PostgreSQL backends - removed support for braces expansion in directory listings has been disabled CVE-2011-0418 - list of allowed ciphers for SSL/TLS connections can be specified Note that Tenable Network...

PlayStation Network Security Update !

On Tuesday, April 26 Sony shared that some information that was compromised in connection with an illegal and unauthorized intrusion into our network. Once again, Sony'd like to apologize to the many users who were inconvenienced and worried about this situation. Sony want to state this again giv...

Debian Security Advisory DSA 2150-1 (request-tracker3.6)

The remote host is missing an update to request-tracker3.6 announced via advisory DSA 2150-1. OpenVAS Vulnerability Test $Id: deb21501.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2150-1 request-tracker3.6 Authors: Thomas Reinke Copyright: Copyright c 20...

Debian: Security Advisory (DSA-2150-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache Derby 'BUILTIN' Authentication Insecure Password Hashing

According to its self-reported version number, the installation of Apache Derby running on the remote server performs a transformation on passwords that removes half the bits from most of the characters before hashing. This leads to a large number of hash collisions, letting passwords be easily...

CVE-2011-0043

Kerberos in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 supports weak hashing algorithms, which allows local users to gain privileges by operating a service that sends crafted service tickets, as demonstrated by the CRC32 algorithm, aka "Kerberos Unkeyed Checksum Vulnerability."...

Design/Logic Flaw

Kerberos in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 supports weak hashing algorithms, which allows local users to gain privileges by operating a service that sends crafted service tickets, as demonstrated by the CRC32 algorithm, aka "Kerberos Unkeyed Checksum Vulnerability."...

CVE-2011-0043

CVE-2011-0043 affects Kerberos in Windows XP SP2/SP3 and Windows Server 2003 SP2. The root cause is use of weak hashing (CRC32) in service tickets, enabling local privilege escalation by a crafted service ticket. Public mitigations are documented in MS11-013, which addresses Kerberos-related elev...

CVE-2011-0043

Kerberos in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 supports weak hashing algorithms, which allows local users to gain privileges by operating a service that sends crafted service tickets, as demonstrated by the CRC32 algorithm, aka "Kerberos Unkeyed Checksum Vulnerability."...

Microsoft Kerberos Privilege Escalation Vulnerabilities (2496930)

This host is missing a critical security update according to Microsoft Bulletin MS11-013. OpenVAS Vulnerability Test $Id: secpodms11-013.nasl 5362 2017-02-20 12:46:39Z cfi $ Microsoft Kerberos Privilege Escalation Vulnerabilities 2496930 Authors: Antu Sanadi Updated by: Antu Sanadi on 2011-03-17...

MS11-013: Vulnerabilities in Kerberos Could Allow Elevation of Privilege (2496930)

The implementation of Kerberos on the remote Windows host is affected by one or more vulnerabilities : - Microsoft's Kerberos implementation uses a weak hashing mechanism, which can allow for certain aspects of a Kerberos service ticket to be forged. Note that this is not exploitable on domains...

Debian DSA-2150-1 : request-tracker3.6 - unsalted password hashing

It was discovered that Request Tracker, an issue tracking system, stored passwords in its database by using an insufficiently strong hashing method. If an attacker would have access to the password database, he could decode the passwords stored in it. %NASLMINLEVEL 70300 C Tenable Network Securit...

[SECURITY] [DSA 2150-1] request-tracker3.6 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2150-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst January 22, 2011 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2150-1] request-tracker3.6 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2150-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst January 22, 2011 http://www.debian.org/security/faq -...

DSA-2150-1 request-tracker3.6 - salt password hashing

Bulletin has no description...

Implement salting of user passwords

Salting and Hashing of user passwords will require us to provide an upgrade path for users since all existing passwords will become invalid. This change should use the atlassian-security password encode library SEC-1...