CVE-2002-1657

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

PostgreSQL uses the username for a salt when generating passwords, which makes it easier for remote attackers to guess passwords via a brute force attack.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-916

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.postgresql.org/pgsql-admin/2002-08/msg00253.phpMailing List
http://marc.info/?l=bugtraq&m=111402558115859&w=2Mailing List
http://marc.info/?l=bugtraq&m=111403050902165&w=2Mailing List
https://exchange.xforce.ibmcloud.com/vulnerabilities/20215Broken Link, VDB Entry
http://archives.postgresql.org/pgsql-admin/2002-08/msg00253.phpMailing List
http://marc.info/?l=bugtraq&m=111402558115859&w=2Mailing List
http://marc.info/?l=bugtraq&m=111403050902165&w=2Mailing List
https://exchange.xforce.ibmcloud.com/vulnerabilities/20215Broken Link, VDB Entry

Timeline

Published: Dec 31, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-16584.6Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument. NOTE: since CVE-2002-165910.0user_profile.asp in PortalApp 2.2 allows local users to gain privileges by modifying the user_id variable.CVE-2002-16607.5calendar.php in vBulletin before 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the command paramet CVE-2002-16615.0The leafnode server in leafnode 1.9.20 to 1.9.29 allows remote attackers to cause a denial of service (infinite loop) when leafnode requests CVE-2002-16626.8Multiple cross-site scripting (XSS) vulnerabilities in Mambo Site Server 4.0.11 allow remote attackers to execute arbitrary script on other CVE-2002-16635.0The Post_Method function in method.c for Monkey HTTP Daemon before 0.5.1 allows remote attackers to cause a denial of service (crash) via a CVE-2002-16646.4Yahoo! Messenger before February 2002 allows remote attackers to add arbitrary users to another user's buddy list and possibly obtain sensit CVE-2002-16657.5Buffer overflow in Yahoo! Messenger before February 2002 allows remote attackers to cause a denial of service (crash) and possibly execute a CVE-2002-16665.0Unknown vulnerability in Oracle E-Business Suite 11i.1 through 11i.6 allows remote attackers to execute unauthorized PL/SQL procedures by mo CVE-2002-16672.1The virtual memory management system in FreeBSD 4.5-RELEASE and earlier does not properly check the existence of a VM object during page inv CVE-2002-16682.1HP-UX 11.11 and earlier allows local users to cause a denial of service (kernel deadlock), due to a "file system weakness" that is possibly CVE-2002-16692.1pkg_add in FreeBSD 4.2 through 4.4 creates a temporary directory with world-searchable permissions, which may allow local users to modify wo