Sonatype Plexus Cipher 'PBECipher.java' File Insecure Salt Generation Weakness

Bugtraq ID:	56873
Class:	Design Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Nov 26 2012 12:00AM
Updated:	Nov 26 2012 12:00AM
Credit:	Florian Weimer
Vulnerable:	Red Hat Fedora 17 Red Hat Fedora 16
Not Vulnerable:

Sonatype Plexus Cipher 'PBECipher.java' File Insecure Salt Generation Weakness

Plexus Cipher is prone to an insecure salt-generation weakness.

To exploit this issue, an attacker needs to gain access to password hashes by some other means (such as exploiting another vulnerability).

An attacker can exploit this weakness to obtain sensitive information by cracking the hashes at a faster rate.

Sonatype Plexus Cipher 'PBECipher.java' File Insecure Salt Generation Weakness

Currently, we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sonatype Plexus Cipher 'PBECipher.java' File Insecure Salt Generation Weakness

Solution:
Updates are available. Please see the references for more information.

Sonatype Plexus Cipher 'PBECipher.java' File Insecure Salt Generation Weakness

References:

• Bug 880279 - plexus-cipher: improper use of SecureRandom in PBECipher (Bugzilla)
  
• Improve randomness of PBECipher salt (GitHub)
  
• Sonatype Homepage (Sonatype)