CVE-2006-4068 Weak cryptography in n/a
Weak client-side hashing in pswd.js allows remote attackers to bypass authentication via offline brute force or collision attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-4068?
CVE-2006-4068 is a medium-severity vulnerability in n/a, published on 10 Aug 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The pswd.js script relies on the client to calculate whether a username and password match hard-coded hashed values for a server, and uses a hashing scheme that creates a large number of collisions, which makes it easier for remote attackers to conduct offline brute force attacks. NOTE: this script might also allow attackers to generate the server-side "secret" URL without determining the original password, but this possibility was not discussed by the original researcher.
Weakness: CWE-255
Which versions are affected by CVE-2006-4068?
It affects 1 product.
Products include Pswd.js Pswd.js.
How do I fix CVE-2006-4068?
No fix has been published for CVE-2006-4068 yet. Limit exposure of the affected software until one is available.
Is CVE-2006-4068 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-4068 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-5jmg-gc72-rrxh.