Empty String Password - Revision history

Johanna Curiel at 20:41, 31 August 2015

2015-08-31T20:41:12Z

2012-09-05T14:31:20Z

corrected grammar

2009-03-07T20:50:31Z

2009-02-21T18:34:13Z

‎Description

2009-02-21T00:38:51Z

2009-02-18T02:16:36Z

2008-10-30T13:15:52Z

2008-09-24T00:08:35Z

2006-07-21T18:34:04Z

Merged with contents provided by Fortify.

2006-06-12T20:15:07Z

@@ Line 10: / Line 10: @@
 Using an empty string as a password is insecure.
-It is never appropriate to use an empty string as a password. It is too easy to guess. Empty string password makes the authentication as weak as the user names, which are normally public or guessable. This make a brute-force attack against the login interface much easier.
+It is never appropriate to use an empty string as a password. It is too easy to guess. An empty string password makes the authentication as weak as the user names, which are normally public or guessable. This makes a brute-force attack against the login interface much easier.
 ==Risk Factors==

← Older revision		Revision as of 20:50, 7 March 2009
Line 45:		Line 45:
	TBD		TBD

−	~~[[Category:FIXME\|add links~~

−	~~In addition, one should classify vulnerability based on the following subcategories: Ex:<nowiki>[[Category:Error Handling Vulnerability]]</nowiki>~~
−
−	~~Availability Vulnerability~~
−
−	~~Authorization Vulnerability~~
−
−	~~Authentication Vulnerability~~
−
−	~~Concurrency Vulnerability~~
−
−	~~Configuration Vulnerability~~
−
−	~~Cryptographic Vulnerability~~
−
−	~~Encoding Vulnerability~~
−
−	~~Error Handling Vulnerability~~
−
−	~~Input Validation Vulnerability~~
−
−	~~Logging and Auditing Vulnerability~~
−
−	~~Session Management Vulnerability]]~~

	__NOTOC__		__NOTOC__

← Older revision		Revision as of 18:34, 21 February 2009
Line 11:		Line 11:

	It is never appropriate to use an empty string as a password. It is too easy to guess. Empty string password makes the authentication as weak as the user names, which are normally public or guessable. This make a brute-force attack against the login interface much easier.		It is never appropriate to use an empty string as a password. It is too easy to guess. Empty string password makes the authentication as weak as the user names, which are normally public or guessable. This make a brute-force attack against the login interface much easier.
−
−	~~Attackers try to obtain a log in account of the application.~~
−
−

	==Risk Factors==		==Risk Factors==

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
 {{Template:Fortify}}
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
+[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
 ==Description==

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
-[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
+__TOC__
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 ==Description==
@@ Line 89: / Line 88: @@
 [[Category:Environmental Vulnerability]]
 [[Category:Deployment]]

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
-==Abstract==
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
 Using an empty string as a password is insecure.
 It is never appropriate to use an empty string as a password. It is too easy to guess. Empty string password makes the authentication as weak as the user names, which are normally public or guessable. This make a brute-force attack against the login interface much easier.
-==Examples ==
+Attackers try to obtain a log in account of the application.
-==Related Attacks==
+==Risk Factors==
-* [[Brute-force Attack]] against application log in interface.
-==Related Vulnerabilities==
+==Related [[Controls]]==
 * [[:Category:Authentication]]
 * [[Strong Password Policy]]
 [[Category:Password Management Vulnerability]]
 [[Category:Authentication Vulnerability]]
 [[Category:Environmental Vulnerability]]
 [[Category:Deployment]]

@@ Line 22: / Line 22: @@
 ==Categories==
-[[Category:Password Management Problem]]
+[[Category:Password Management Vulnerability]]
 {{Template:Stub}}