CVE-2012-2143

The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not p… (CVE-2012-2143)

Description

The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.

Source: CVELISTV5 NVD

Metrics

Severity

none

55.54

—

no public PoC known

—

—

—

92.6 %

Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).

EPSS score

5.7 %

Moderate — model estimates 1-10% exploitation likelihood.

Published

2012-07-05 14:00 UTC

CWE

—

Affected operating systems

linux
debian / debian_linux6.0
os
freebsd / freebsd
os
freebsd / freebsd1.0
os
freebsd / freebsd1.1
os
freebsd / freebsd1.1.5
os
freebsd / freebsd1.1.5.1
os
freebsd / freebsd2.0
os
freebsd / freebsd2.0.5
os
freebsd / freebsd2.1
os
freebsd / freebsd2.1.5
os
freebsd / freebsd2.1.6
os
freebsd / freebsd2.1.7
os
freebsd / freebsd2.2
os
freebsd / freebsd2.2.1
os
freebsd / freebsd2.2.2
os
freebsd / freebsd2.2.5
os
freebsd / freebsd2.2.6
os
freebsd / freebsd2.2.7
os
freebsd / freebsd2.2.8
os
freebsd / freebsd3.0
os
freebsd / freebsd3.1
os
freebsd / freebsd3.2
os
freebsd / freebsd3.3
os
freebsd / freebsd3.4

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

php
php5.4.0 – 5.4.4
php
php5.3.14
postgresql
postgresql8.3 – 8.3.19
postgresql
postgresql8.4 – 8.4.12
postgresql
postgresql9.0 – 9.0.8
postgresql
postgresql9.1 – 9.1.4

References & sources

IDCVE-2012-2143