Secunia

A weakness has been reported in Openwall crypt_blowfish, which potentially can be exploited by malicious, local users to bypass certain security restrictions.

The weakness is caused due to signedness errors in crypt_gensalt.c. This increases the probability that certain extended-DES-based and MD5-based password hashes are generated using the same salt.

Successful exploitation allows the hashes to be tested against candidate passwords at a faster effective rate but requires access to the password file.

The weakness has been reported in version 0.4.7 and prior.

Solution
Update to version 1.0
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Marko Kreen.

Changelog
Further details available in Customer Area

Original Advisory
http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/glibc/crypt_blowfish/crypt_gensalt.c?only_with_tag=CRYPT_BLOWFISH_1_0
http://article.gmane.org/gmane.comp.security.bugtraq/21754

Deep Links
Links available in Customer Area