The vulnerability is "not using a password hash construction", of which the best known are bcrypt and PBKDF2.
You could slap MD5 into PBKDF2 with a high iteration count and achieve comparable security. The problem is that devs often use a hash function a single time.
Password hash constructions do more than simply run the hash function multiple times.
We are, obviously, saying much the same thing.
Again: the key point here is, don't DIY this part of your application.
If you don't have a reasonable salt then you're vulnerable to time/space tradeoff attacks like rainbow tables/etc.
Also, in case you haven't used it. Scrypt is pretty damn awesome. It's designed to be memory hard, which makes it very hard to crack even with GPUs.