BusyBox Insecure Password Hash Weakness
BID:17330
Info
BusyBox Insecure Password Hash Weakness
| Bugtraq ID: | 17330 |
| Class: | Design Error |
| CVE: |
CVE-2006-1058 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Mar 31 2006 12:00AM |
| Updated: | Jun 29 2007 03:18PM |
| Credit: | This issue was reported to the vendor by taviso. |
| Vulnerable: |
Redhat Enterprise Linux WS 4 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux AS 4 Redhat Desktop 4.0 BusyBox Linux Utilities 1.1.2 BusyBox Linux Utilities 1.1.1 Avaya SES 3.1.1 Avaya SES 3.0 Avaya SES 2.0 Avaya Messaging Storage Server MSS 3.0 Avaya Message Networking MN 3.1 Avaya Message Networking Avaya Communication Manager 2.0.1 Avaya Communication Manager 2.0 Avaya Communication Manager 4.0 Avaya Communication Manager 3.1 Avaya Communication Manager 3.0 Avaya CCS 3.1.1 Avaya CCS 3.0 Avaya CCS 2.0 Avaya AES 4.0 |
| Not Vulnerable: |
BusyBox Linux Utilities 1.1.3 |
Discussion
BusyBox Insecure Password Hash Weakness
BusyBox is prone to an insecure password-hash weakness. This issue is due to a design flaw that results in password hashes being created in an insecure manner.
This issue allows attackers to use precomputed password hashes in brute-force attacks if they can gain access to password hashes by some means (such as exploiting another vulnerability).
BusyBox is prone to an insecure password-hash weakness. This issue is due to a design flaw that results in password hashes being created in an insecure manner.
This issue allows attackers to use precomputed password hashes in brute-force attacks if they can gain access to password hashes by some means (such as exploiting another vulnerability).
Exploit / POC
BusyBox Insecure Password Hash Weakness
Attackers use precomputed password hashes to exploit this issue.
Attackers use precomputed password hashes to exploit this issue.
Solution / Fix
BusyBox Insecure Password Hash Weakness
Solution:
The vendor has released version 1.1.3 to address this issue; please see the reference section for details.
Solution:
The vendor has released version 1.1.3 to address this issue; please see the reference section for details.
References
BusyBox Insecure Password Hash Weakness
References:
References:
- 0000604: passwd doesnt use salt with md5 passwords (BusyBox)
- ASA-2007-250 - busybox security update (Avaya)
- BusyBox Home Page (BusyBox)
- RHSA-2007:0244 busybox security update (Red Hat)