Crypt::PasswdMD5 versions through 1.42 for Perl generate insecure random values for cryptographic salts, allowing potential hash compromise.

This vulnerability involves the use of a cryptographically weak pseudo-random number generator, specifically the built-in Perl rand function, within an unauthenticated network context.

The use of predictable random values for password salting severely weakens cryptographic protection against brute-force and rainbow table attacks. A successful exploitation of this flaw can lead to unauthorized access and severe credential compromise across affected systems. This risk is reflected in the CVSS score of 7.5, which highlights the high potential for confidentiality loss.

Immediate Action: Upgrade Crypt::PasswdMD5 to version 1.43 or later.

Proactive Monitoring: Monitor authentication logs and password generation routines for anomalies or signs of credential brute-forcing.

Compensating Controls: Implement strong password complexity requirements and account lockout policies to mitigate the risks associated with weak password hashing.

Public Exploit Available: No (unknown)

Organizations utilizing the RSAVAGE Crypt::PasswdMD5 module must apply the vendor security update to version 1.43 immediately. Promptly addressing this flaw ensures that cryptographic salts are generated securely, preventing potential credential exposure and unauthorized system access.