CVE-2006-0591
solar designer crypt blowfish: no CVSS score yet. EPSS 0.4% chance of exploitation in the next 30 days.
The crypt_gensalt functions for BSDI-style extended DES-based and FreeBSD-sytle MD5-based password hashes in crypt_blowfish 0.4.7 and earlier do not evenly and randomly distribute salts, which makes it easier for attackers to guess passwords from a stolen password file due to the increased number of collisions.
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
- CWE
- CWE-310
- Published
- Modified
- Record from
- the NVD, synced
Affected
- solar_designer:crypt_blowfish
References
- ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc
- http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/glibc/crypt_blowfish/crypt_gensalt.c?only_with_tag=CRYPT_BLOWFISH_1_0
- http://secunia.com/advisories/18772
- http://secunia.com/advisories/20232
- http://secunia.com/advisories/20653