Description
The crypt_gensalt functions for BSDI-style extended DES-based and FreeBSD-sytle MD5-based password hashes in crypt_blowfish 0.4.7 and earlier do not evenly and randomly distribute salts, which makes it easier for attackers to guess passwords from a stolen password file due to the increased number of collisions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | postgresql +10 | 7.4.13-2.RHEL4.1 | RHSA-2006:0526 |
| RHEL 3 | rh-postgresql +10 | 7.3.15-2 | RHSA-2006:0526 |
Advisories 1
- RHSA-2006:0526 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 20060207 crypt_blowfish 1.0 mailing-list
- 20653 third-party-advisory
- cryptblowfish-salt-information-disclosure(24590) vdb-entry
- 20782 third-party-advisory
- RHSA-2006:0526 vendor-advisory
- 18772 third-party-advisory
- 23005 vdb-entry
- 20232 third-party-advisory
- ADV-2006-0477 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2006-113.htm
- oval:org.mitre.oval:def:11502 vdb-entry signature
- http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/glibc/crypt_blowfish/crypt_gensalt.c?only_with_tag=CRYPT_BLOWFISH_1_0