CVE

Id
41704  
CVE No.
CVE-2009-4269  
Status
Candidate  
Description
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.  
Phase
Assigned (20091210)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
457768 41704 CVE-2009-4269 MLIST:[apache-db-general] 20100519 [ANNOUNCE] Apache Derby 10.6.1.0 released  View
457769 41704 CVE-2009-4269 URL:http://marc.info/?l=apache-db-general&m=127428514905504&w=1  View
457770 41704 CVE-2009-4269 MISC:http://blogs.sun.com/kah/entry/derby_10_6_1_has  View
457771 41704 CVE-2009-4269 MISC:http://marcellmajor.com/derbyhash.html  View
457772 41704 CVE-2009-4269 CONFIRM:http://db.apache.org/derby/releases/release-10.6.1.0.cgi#Fix+for+Security+Bug+CVE-2009-4269  View
457773 41704 CVE-2009-4269 CONFIRM:https://issues.apache.org/jira/browse/DERBY-4483  View
457774 41704 CVE-2009-4269 CONFIRM:http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html  View
457775 41704 CVE-2009-4269 BID:42637  View
457776 41704 CVE-2009-4269 URL:http://www.securityfocus.com/bid/42637  View
457777 41704 CVE-2009-4269 SECTRACK:1024977  View
457778 41704 CVE-2009-4269 URL:http://www.securitytracker.com/id?1024977  View
457779 41704 CVE-2009-4269 SECUNIA:42970  View
457780 41704 CVE-2009-4269 URL:http://secunia.com/advisories/42970  View
457781 41704 CVE-2009-4269 SECUNIA:42948  View
457782 41704 CVE-2009-4269 URL:http://secunia.com/advisories/42948  View
457783 41704 CVE-2009-4269 VUPEN:ADV-2011-0149  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
35370 JVNDB-2010-001150 SystemTap の stap-server における任意のコマンドを実行される脆弱性 SystemTap の stap-server には、任意のコマンドを実行される脆弱性が存在します。 CVE-2009-4273 41704 10 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001150.html  View