PSWD.JS Insecure Password Hash Weakness

Bugtraq ID:	19333
Class:	Design Error
CVE:	CVE-2006-4068
Remote:	Yes
Local:	No
Published:	Aug 03 2006 12:00AM
Updated:	Mar 08 2007 03:55AM
Credit:	Gianstefano Monni has been credited with the discovery of this vulnerability.
Vulnerable:	pswd.js pswd.js 0
Not Vulnerable:

PSWD.JS Insecure Password Hash Weakness

Applications running pswd.js are prone to an insecure password-hash weakness. This issue is due to a design flaw that results in password hashes being created in an insecure manner.

This issue allows attackers to use precomputed password hashes in brute-force attacks and authenticate themselves against the vulnerable application running the script. A successful exploit of this issue may lead to other attacks.

PSWD.JS Insecure Password Hash Weakness

The following exploit code has been provided:

• /data/vulnerabilities/exploits/PswdJSHashWeaknessAugust032006.c

PSWD.JS Insecure Password Hash Weakness

Solution:
Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

PSWD.JS Insecure Password Hash Weakness

References:

• Javascript software authentication brute force attack (Gianstefano Monni)