The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to ensure the new password is stored more securely. Products should encourage customers to take this step as a high priority action. IBM X-Force ID: 139972.
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
| Link | Tags |
|---|---|
| http://www.ibm.com/support/docview.wss?uid=swg22015066 | patch vendor advisory |
| http://www.ibm.com/support/docview.wss?uid=swg22014957 | patch vendor advisory |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/139972 | vdb entry vendor advisory |
| http://www.ibm.com/support/docview.wss?uid=swg22015071 | patch vendor advisory |
| http://www.securityfocus.com/bid/104511 | vdb entry |
| http://www.securitytracker.com/id/1041012 | vdb entry |
| http://www.ibm.com/support/docview.wss?uid=swg22014669 | patch vendor advisory |