[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAJmbs8jE4fU49N-e+VpC6eqDdYACO1ZSb9FxLQxOVzNbnN8YqQ@mail.gmail.com>
Date: Fri, 25 Mar 2016 15:47:55 +0600
From: Maxim Solodovnik <solomax@...che.org>
To: Openmeetings user-list <user@...nmeetings.apache.org>, dev <dev@...nmeetings.apache.org>,
security@...che.org, security@...nmeetings.apache.org,
oss-security@...ts.openwall.com, bugtraq@...urityfocus.com
Subject: [CVE-2016-0783] Predictable password reset token
Severity: Critical
Vendor: The Apache Software Foundation
Versions Affected: Apache OpenMeetings 1.9.x - 3.1.0
Description:
The hash generated by the external password reset function is
generated by concatenating the user name and the current system time,
and then hashing it using MD5. This is highly predictable and can be
cracked in seconds by an attacker with knowledge of the user name of
an OpenMeetings user.
All users are recommended to upgrade to Apache OpenMeetings 3.1.1
Credit: This issue was identified by Andreas Lindh
Apache OpenMeetings Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
