Date: Fri, 25 Mar 2016 15:47:55 +0600 From: Maxim Solodovnik <solomax@...che.org> To: Openmeetings user-list <user@...nmeetings.apache.org>, dev <dev@...nmeetings.apache.org>, security@...che.org, security@...nmeetings.apache.org, oss-security@...ts.openwall.com, bugtraq@...urityfocus.com Subject: [CVE-2016-0783] Predictable password reset token Severity: Critical Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings 1.9.x - 3.1.0 Description: The hash generated by the external password reset function is generated by concatenating the user name and the current system time, and then hashing it using MD5. This is highly predictable and can be cracked in seconds by an attacker with knowledge of the user name of an OpenMeetings user. All users are recommended to upgrade to Apache OpenMeetings 3.1.1 Credit: This issue was identified by Andreas Lindh Apache OpenMeetings Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ