CVE-2006-0591: Low severity Solar Designer Crypt Blowfish vulnerability
The cryptgensalt functions for BSDI-style extended DES-based and FreeBSD-sytle MD5-based password hashes in cryptblowfish 0.4.7 and earlier do not evenly and randomly distribute salts, which makes it easier for attackers to guess passwords from a stolen password file due to the increased number of collisions.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-0591?
CVE-2006-0591 is classified as a high severity vulnerability due to the ease with which attackers can guess passwords.
How does CVE-2006-0591 affect password security?
CVE-2006-0591 affects password security by allowing attackers to exploit uneven salt distribution, increasing the likelihood of password cracking.
How do I fix CVE-2006-0591?
To fix CVE-2006-0591, upgrade to a later version of crypt_blowfish that addresses the salt distribution issue.
Which versions of crypt_blowfish are affected by CVE-2006-0591?
CVE-2006-0591 specifically affects crypt_blowfish version 0.4.7 and earlier.
What specific functions are involved in CVE-2006-0591?
The crypt_gensalt functions are involved in CVE-2006-0591, leading to vulnerabilities in extended DES and MD5-based password hashing.