[VIM] CVE-2006-0591 (crypt_blowfish) (fwd)

[Steven M. Christey]

The CVE description for crypt_blowfish originally had a couple
inaccuracies in it, including claiming a remote attack vector.  Solar
Designer sent us the following email with corrections, and given that he
mentioned trying to get this fixed in other vuln DBs, I thought I'd pass
it on.

- Steve


---------- Forwarded message ----------
Date: Sat, 18 Feb 2006 00:41:45 +0300
From: Solar Designer
To: cve at mitre.org
Subject: CVE-2006-0591 (crypt_blowfish)

Hi,

After trying to get this misinformation corrected in several
vulnerability databases, I realized that it actually comes from CVE...

The description says:

"The crypt_gensalt functions for BSDI-style extended DES-based and
FreeBSD-sytle MD5-based password hashes in crypt_blowfish 0.4.7 and
earlier do not evenly and randomly distribute salts across the hash
space, which makes it easier for remote attackers to guess passwords due
to the increased number of collisions."

The word "remote" is very wrong.  One has to have a copy of the shadow
password file (perhaps obtained via _another_ vulnerability) in order to
exploit this.

Also, the words "across the hash space" are wrong.  Salts are not a part
of the hash space.

I suggest that you correct the description as follows:

"The crypt_gensalt functions for BSDI-style extended DES-based and
FreeBSD-style MD5-based password hashes in crypt_blowfish 0.4.7 and
earlier do not evenly and randomly distribute salts, which makes it
easier for attackers with a stolen copy of the password file to guess
passwords due to the increased number of salt collisions."

Thanks,

-- 
/sd