Today the PHP, OpenBSD and FreeBSD communities announced updates to patch a security hole involving their crypt() hashing algorithms. This issue is described in CVE-2012-2143. This vulnerability also affects a minority of PostgreSQL users, and will be fixed in an update release on June 4, 2012.

Affected users are those who use the crypt(text, text) function with DES encryption in the optional pg_crypto module. Passwords affected are those that contain characters that cannot be represented with 7-bit ASCII. If a password contains a character that has the most significant bit set (0x80), and DES encryption is used, that character and all characters after it will be ignored.

Users of high-security applications who cannot wait for the update are recommended to do one of three things:

• switch from using crypt() with DES to a more current encryption algorithm such as Blowfish.
• download the patch, patch their own installations in source code form, reinstall pg_crypto, disconnect all sessions and restart them to reload the library or restart the server.
• add a check to ensure that all passwords hashed with crypt() do not allow the value 0x80.

Note that users who patch their installations, or who apply the update on June 4th, may need to regenerate passwords for some or all of their application users due to the change in the hashing algorithm. Specifically, after the update, passwords containing 0x80 will no longer work.

The PostgreSQL Project regrets the inconvenience to our users. We are grateful to security researchers Robin Xu and Joseph Bonneau for discovering this issue.

For more information on the pg_crypto module, please see the documentation.

REDMOND , Wash. — May 29 , 2012 — Microsoft Corp. has announced the Herbalife Ltd. Inc. decision to host its global distributors’ websites on Windows Azure. The nutrition company is now offering its independent distributors the option to create custom retail websites to help them expand their businesses. By building the website platform on Windows Azure, Herbalife substantially reduced its time to market, eliminated the need for significant capital investment and made it possible for the company to react to changing capacity demands in real time.

Herbalife wanted to give its distributors in more than 80 countries the opportunity to build customized retail experiences for shoppers. However, the costs needed to support the creation of individual websites for its distributors worldwide would have been massive if Herbalife had taken on all the work: licensing, obtaining hardware and constructing datacenters. Herbalife wanted to roll out this offering slowly to ensure that it had the features distributors needed. However, the company also required an infrastructure with the flexibility to rapidly scale across markets once the base offering was in place: attempting to do both without the cloud would have introduced significant risk.

Herbalife turned to the cloud to find a solution. Herbalife discovered that Windows Azure provided both flexibility and cost efficiencies needed to help it meet its business goals and now has the scalability and flexibility it needs, with Herbalife independent distributors on track to launch a projected 100,000 retail websites within the first three years of deployment.

“Herbalife was able to use its existing Microsoft ASP.NET expertise and Microsoft Visual Studio 2010 Ultimate tools to create the cloud-based website platform it wanted,” said Doug Hauger, general manager, Windows Azure, Microsoft Corp. “This kind of global consistency will help keep Herbalife’s independent distributors on the forefront of retail website strategies.”

More information is available on the Microsoft Customer Spotlight newsroom.

Founded in 1975, Microsoft (Nasdaq “MSFT”) is the worldwide leader in software, services and solutions that help people and businesses realize their full potential.

Note to editors: For more information, news and perspectives from Microsoft, please visit the Microsoft News Center at http://www.microsoft.com/news. Web links, telephone numbers and titles were correct at time of publication, but may have changed. For additional assistance, journalists and analysts may contact Microsoft’s Rapid Response Team or other appropriate contacts listed at http://www.microsoft.com/news/contactpr.mspx.