CVE-2006-0584: Low severity PeopleSoft PeopleTools vulnerability
The PSCipher function in PeopleSoft People Tools 8.4x uses PKCS #5 with a fixed DES key to store user passwords, which makes it easier for local users to guess passwords using a dictionary attack that compares output strings.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-0584?
CVE-2006-0584 is considered to have a medium severity due to its potential for dictionary attacks on user passwords.
How do I fix CVE-2006-0584?
To mitigate CVE-2006-0584, it is recommended to upgrade to a newer version of Oracle PeopleSoft PeopleTools that does not use fixed DES keys.
What versions of PeopleSoft PeopleTools are affected by CVE-2006-0584?
CVE-2006-0584 affects versions 8.40 through 8.46.3 of Oracle PeopleSoft PeopleTools.
What impact does CVE-2006-0584 have on user security?
CVE-2006-0584 can lead to unauthorized access as local users can guess passwords more easily through dictionary attacks.
Is CVE-2006-0584 still a concern today?
Yes, CVE-2006-0584 remains a concern for organizations using the affected versions of PeopleSoft PeopleTools without proper remediation.