CVE-2006-1058

MEDIUM

BusyBox 1.1.1 - Use of Password Hash With Insufficient Computational Effort

Title source: llm
STIX 2.1

Description

BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables.

References (9)

Core 9
Core References
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25098
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/17330
Broken Link, Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19477
Broken Link x_refsource_confirm
http://bugs.busybox.net/view.php?id=604
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25848
Third Party Advisory x_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2007-250.htm
Broken Link vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-0244.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/25569

Scores

CVSS v3 5.5
EPSS 0.0029
EPSS Percentile 20.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-916
Status published
Products (6)
avaya/aura_application_enablement_services 4.01
avaya/aura_application_enablement_services 4.1
avaya/aura_sip_enablement_services < 5.0
avaya/message_networking
avaya/messaging_storage_server 3.0 - 4.0
busybox/busybox 1.1.1
Published Apr 04, 2006
Tracked Since Feb 18, 2026