Test ID:	1.3.6.1.4.1.25623.1.0.801284
Category:	Databases
Title:	Apache Derby Information Disclosure Vulnerability
Summary:	Apache Derby is prone to an information disclosure vulnerability.
Description:	Summary: Apache Derby is prone to an information disclosure vulnerability. Vulnerability Insight: The flaw is due to a weaknesses in the password hash generation algorithm used in Derby to store passwords in the database, performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions. Vulnerability Impact: Successful exploitation will let remote attackers to crack passwords by generating hash collisions. Affected Software/OS: Apache Derby versions before 10.6.1.0. Solution: Upgrade to Apache Derby version 10.6.1.0 or later. CVSS Score: 2.1 CVSS Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-4269 BugTraq ID: 42637 http://www.securityfocus.com/bid/42637 http://blogs.sun.com/kah/entry/derby_10_6_1_has http://marcellmajor.com/derbyhash.html http://marc.info/?l=apache-db-general&m=127428514905504&w=1 http://www.securitytracker.com/id?1024977 http://secunia.com/advisories/42948 http://secunia.com/advisories/42970 http://www.vupen.com/english/advisories/2011/0149
Copyright	Copyright (C) 2010 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.