National Cyber Awareness System

Vulnerability Summary for CVE-2009-4269

Overview

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.

Description

Per https://issues.apache.org/jira/browse/DERBY-4483, the reported version affected is 10.5.3.0. Unable to determine if affected versions exist between 10.5.3.0 and 10.6.1.0

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://issues.apache.org/jira/browse/DERBY-4483

Type: Advisory

Hyperlink:https://issues.apache.org/jira/browse/DERBY-4483

External Source: VUPEN

Name: ADV-2011-0149

Hyperlink:http://www.vupen.com/english/advisories/2011/0149

External Source: SECTRACK

Name: 1024977

Hyperlink:http://www.securitytracker.com/id?1024977

External Source: BID

Name: 42637

Hyperlink:http://www.securityfocus.com/bid/42637

External Source: CONFIRM

Name: http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html

Hyperlink:http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html

External Source: SECUNIA

Name: 42970

Hyperlink:http://secunia.com/advisories/42970

External Source: SECUNIA

Name: 42948

Hyperlink:http://secunia.com/advisories/42948

External Source: MISC

Name: http://marcellmajor.com/derbyhash.html

Hyperlink:http://marcellmajor.com/derbyhash.html

External Source: MLIST

Name: [apache-db-general] 20100519 [ANNOUNCE] Apache Derby 10.6.1.0 released

Hyperlink:http://marc.info/?l=apache-db-general&m=127428514905504&w=1

External Source: CONFIRM

Name: http://db.apache.org/derby/releases/release-10.6.1.0.cgi#Fix+for+Security+Bug+CVE-2009-4269

Hyperlink:http://db.apache.org/derby/releases/release-10.6.1.0.cgi#Fix+for+Security+Bug+CVE-2009-4269

External Source: MISC

Name: http://blogs.sun.com/kah/entry/derby_10_6_1_has

Hyperlink:http://blogs.sun.com/kah/entry/derby_10_6_1_has