Apache Derby 'BUILTIN' Authentication Insecure Password Hashing

High Nessus Plugin ID 52536

Synopsis

The remote database server is running software known to be susceptible to brute-forcing of passwords.

Description

According to its self-reported version number, the installation of Apache Derby running on the remote server performs a transformation on passwords that removes half the bits from most of the characters before hashing. This leads to a large number of hash collisions, letting passwords be easily brute-forced. This vulnerability only affects the BUILTIN authentication method.

Note that Nessus has not tested for the issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Apache Derby 10.6.1.0 or later.

See Also

https://issues.apache.org/jira/browse/DERBY-4483

http://db.apache.org/derby/releases/release-10.6.1.0.html

http://marcellmajor.com/derbyhash.html

Plugin Details

Severity: High

ID: 52536

File Name: derby_10_6_1_0.nasl

Version: 1.5

Type: remote

Family: Databases

Published: 2011/03/03

Modified: 2018/07/10

Dependencies: 22410

Risk Information

Risk Factor: High

CVSSv2

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

Required KB Items: Settings/ParanoidReport

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2010/05/19

Vulnerability Publication Date: 2009/12/18

Reference Information

CVE: CVE-2009-4269

BID: 42637

Secunia: 42948