CVE-2019-0030
15.01.2019, 21:29
Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.Enginsight
| Vendor | Product | Version |
|---|---|---|
| juniper | advanced_threat_prevention_firmware | 5.0.0 ≤ 𝑥 < 5.0.3 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-327 - Use of a Broken or Risky Cryptographic AlgorithmThe use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information.
- CWE-916 - Use of Password Hash With Insufficient Computational EffortThe software generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.