CVE-2012-2143 in PHP

Summary

The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.

Reservation

04/04/2012

Disclosure

07/05/2012

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
5481	PHP crypt_freesec.c cryptographic issue	310	Proof-of-Concept	Official fix	CVE-2012-2143
5477	FreeBSD DES Implementation libcrypt cryptographic issue	310	Proof-of-Concept	Official fix	CVE-2012-2143