CVE-2012-2143 in PHP

Zusammenfassung (Englisch)

The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.

Reservieren

04.04.2012

Veröffentlichung

05.07.2012

Einträge

VulDB provides additional information and datapoints for this CVE:

ID	Schwachstelle	CWE	Aus	Mas	CVE
5481	PHP crypt_freesec.c schwache Verschlüsselung	310	Proof-of-Concept	Offizieller Fix	CVE-2012-2143
5477	FreeBSD DES Implementation libcrypt schwache Verschlüsselung	310	Proof-of-Concept	Offizieller Fix	CVE-2012-2143