CVE-2014-2354: Cogent DataHub Use of Password Hash With Insufficient Computational Effort
Published May 30, 2014
·Updated
Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.
Affected Software
12 affected components
Cogentdatahub Cogent Datahub<=7.3.4
Cogentdatahub Cogent Datahub=7.0
Cogentdatahub Cogent Datahub=7.0.2
Cogentdatahub Cogent Datahub=7.1.0
Cogentdatahub Cogent Datahub=7.1.1
Cogentdatahub Cogent Datahub=7.1.1.63
Cogentdatahub Cogent Datahub=7.1.2
Cogentdatahub Cogent Datahub=7.2.2
Cogentdatahub Cogent Datahub=7.3.0
Cogentdatahub Cogent Datahub=7.3.1
Cogentdatahub Cogent Datahub=7.3.2
Cogentdatahub Cogent Datahub=7.3.3
Remediation
Information
Cogent Real-Time Systems, Inc. has produced a new version of the
Cogent DataHub application, Version 7.3.5, that fixes three of the four
identified vulnerabilities. The updated version is available at the
following address:
http://cogentdatahub.com/Download_Software.html
Cogent
has indicated that it will not be fixing the cryptographic weaknesses
of hashed usernames and passwords because of compatibility issues with
existing systems. Cogent and the researcher agree that an effective
mitigation strategy for users is to select sufficiently strong
passwords. Cogent has indicated that password hashes can be checked for
strength using sites such as: https://crackstation.net/ .
Event History
May 30, 2014
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·11:55 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2354?
CVE-2014-2354 is considered a high severity vulnerability due to its potential for allowing brute-force attacks on hashed passwords.
2
How do I fix CVE-2014-2354?
To fix CVE-2014-2354, upgrade to Cogent DataHub version 7.3.5 or later which includes proper password hashing with salt.
3
What types of attacks are possible with CVE-2014-2354?
CVE-2014-2354 allows attackers to perform brute-force attacks to recover cleartext passwords easily.
4
What versions of Cogent DataHub are affected by CVE-2014-2354?
CVE-2014-2354 affects versions of Cogent DataHub prior to 7.3.5, including versions 7.0 through 7.3.4.
5
Is it possible to exploit CVE-2014-2354 remotely?
Yes, CVE-2014-2354 can be exploited remotely by anyone who has access to the hashed password data.