Wow, we had great feedback on the last bug. Someone emailed me and said that the biggest bug was the blue font on the black background. :)   

Here is another fun bug -
Courtesy of Neelay Shah, Consultant, Foundstone

class CUserManager
{
public:
  void   CreateLogin(String * strUserName, String * strPassword);
  void   AddLoginToDB(String * strUserName, Byte bytePasswordHash[]);
};
 
int _tmain()
{
  CUserManager objUsrMgr;
 
  String * struser = S"newuser";
  String * struserpass = S"password";
 
  objUsrMgr.CreateLogin(struser, struserpass);
 
  return 0;
}
 
void CUserManager::CreateLogin(String * strUserName, String * strPassword)
{
  System::Text::ASCIIEncoding *pAscii = new System::Text::ASCIIEncoding();
 
  Byte bytePassword[] = pAscii->GetBytes(strPassword);
 
  SHA1CryptoServiceProvider *pSha1 = new SHA1CryptoServiceProvider();
  Byte byteHash[] = pSha1->ComputeHash(bytePassword); 
 
  AddLoginToDB(strUserName, byteHash);
 
  return;
}
 
void CUserManager::AddLoginToDB(String * strUserName, Byte bytePasswordHash [])
{
  //Add the user name and the password hash to the database
  return;
}

Solution:

void CUserManager::CreateLogin(String * strUserName, String * strPassword)
{
  System::Text::ASCIIEncoding *pAscii = new System::Text::ASCIIEncoding();
 
  String * strPrependedSalt = CUserManager::GenerateRandomSalt();
  String * strAppendedSalt  = CUserManager::GenerateRandomSalt();
 
   //Prepend and apppend a random salt to the clear-text password so that making the dictionary attacks difficult.
  String * strPasswordWithSalt = String::Concat(strPrependedSalt, strPassword, strAppendedSalt);
 
  Byte bytePassword[] = pAscii->GetBytes(strPasswordWithSalt);
  SHA1CryptoServiceProvider *pSha1 = new SHA1CryptoServiceProvider();
  Byte byteHash[] = pSha1->ComputeHash(bytePassword); 
 
  //Add the 2 clear-text salts to the hash itself.
  String * strHash = String::Concat(strPrependedSalt, pAscii->GetString(byteHash), strAppendedSalt);
 
  AddLoginToDB(strUserName, pAscii->GetBytes(strHash));
 
  return;
}

Description:

           The given code snippet creates a new user. It takes care as in not storing the clear text password anywhere but instead stores the SHA1 hash of the users password in the database. However, one way hash functions are deterministic in nature. Given a string, the resultant hash produced by the one way hash algorithm is always the same. Using the hash algorithms alone can expose the application to “dictionary attacks”. Suppose a malicious user of the application gets hold of the user names and the associated password hashes (may be from the log file) the user can find out if there is any user who has the same password as his or if two users have the same password! Another twist to this is, if the one way hash algorithm is well known the attacker can pre-compute the hashes of all the well known passwords offline, and then employ a brute force attack to get access to the application