Summary
The host is running Apache Derby and is prone to information disclosure vulnerability.
Impact
Successful exploitation will let remote attackers to crack passwords by generating hash collisions.
Impact Level: Application
Solution
Upgrade to Apache Derby version 10.6.1.0 or later, For updates refer to http://db.apache.org/derby/derby_downloads.html
Insight
The flaw is due to a weaknesses in the password hash generation algorithm used in Derby to store passwords in the database, performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions.
Affected
Apache Derby versions before 10.6.1.0
References
Severity
Classification
-
CVE CVE-2009-4269 -
CVSS Base Score: 2.1
AV:L/AC:L/Au:N/C:P/I:N/A:N
Related Vulnerabilities