CVE-2012-2143

 

Published at: - 05-07-2012 04:55

Last modified: - 20-01-2023 06:52

Total changes: - 2

Description

The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.

Common Vulnerability Scoring System (CVSS)

AV:N/AC:M/Au:N/C:N/I:P/A:N

 

Verification logic

 

Reference

• http://www.postgresql.org/support/security/
• http://www.postgresql.org/docs/9.1/static/release-9-1-4.html
• http://git.postgresql.org/gitweb/?p=postgresql.git&a=commit&h=932ded2ed51e8333852e370c7a6dad75d9f236f9
• http://www.postgresql.org/docs/8.3/static/release-8-3-19.html
• FreeBSD-SA-12:02-Vendor Advisory
• http://git.php.net/?p=php-src.git;a=commit;h=aab49e934de1fff046e659cbec46e3d053b41c34
• https://bugzilla.redhat.com/show_bug.cgi?id=816956
• http://www.postgresql.org/docs/8.4/static/release-8-4-12.html
• http://www.postgresql.org/docs/9.0/static/release-9-0-8.html
• SUSE-SU-2012:0840-Mailing List, Third Party Advisory
• MDVSA-2012:092-Broken Link
• FEDORA-2012-8915-Mailing List, Third Party Advisory
• FEDORA-2012-8924-Mailing List, Third Party Advisory
• FEDORA-2012-8893-Mailing List, Third Party Advisory
• DSA-2491-Third Party Advisory
• RHSA-2012:1037-Third Party Advisory
• 1026995-Third Party Advisory, VDB Entry
• APPLE-SA-2012-09-19-2-Mailing List, Third Party Advisory
• http://support.apple.com/kb/HT5501
• openSUSE-SU-2012:1299-Mailing List, Third Party Advisory
• 49304-Broken Link, Vendor Advisory
• openSUSE-SU-2012:1288-Mailing List, Third Party Advisory
• openSUSE-SU-2012:1251-Mailing List, Third Party Advisory
• 50718-Broken Link, Vendor Advisory
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

 

Keywords

NVD

 

CVE-2012-2143

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures