2.1

CVE-2009-4269

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Derby Version <= 10.5.3.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.43% 0.697
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
http://blogs.sun.com/kah/entry/derby_10_6_1_has
http://db.apache.org/derby/releases/release-10.6.1.0.cgi#Fix+for+Security+Bug+CVE-2009-4269
http://marc.info/?l=apache-db-general&m=127428514905504&w=1
http://marcellmajor.com/derbyhash.html
http://secunia.com/advisories/42948
http://secunia.com/advisories/42970
http://www.securityfocus.com/bid/42637
http://www.securitytracker.com/id?1024977
http://www.vupen.com/english/advisories/2011/0149
https://issues.apache.org/jira/browse/DERBY-4483
Vendor Advisory