[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] [CVE-2016-0783] Predictable password reset token
From:       Maxim Solodovnik <solomax () apache ! org>
Date:       2016-03-25 9:47:55
Message-ID: CAJmbs8jE4fU49N-e+VpC6eqDdYACO1ZSb9FxLQxOVzNbnN8YqQ () mail ! gmail ! com
[Download RAW message or body]


Severity: Critical

Vendor: The Apache Software Foundation

Versions Affected: Apache OpenMeetings 1.9.x - 3.1.0

Description:
The hash generated by the external password reset function is
generated by concatenating the user name and the current system time,
and then hashing it using MD5. This is highly predictable and can be
cracked in seconds by an attacker with knowledge of the user name of
an OpenMeetings user.

All users are recommended to upgrade to Apache OpenMeetings 3.1.1

Credit: This issue was identified by Andreas Lindh


Apache OpenMeetings Team


[prev in list] [next in list] [prev in thread] [next in thread]