CVE-2012-2143
En bref
- Source
- NVD
- EPSS
- EPSS 5.73 % · centile 93 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.
Faiblesses (CWE)
Références
- http://www.postgresql.org/docs/9.1/static/release-9-1-4.html
- http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00003.html
- http://security.freebsd.org/advisories/FreeBSD-SA-12:02.crypt.asc
- http://secunia.com/advisories/50718
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082292.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082258.html
- https://bugzilla.redhat.com/show_bug.cgi?id=816956
- http://www.postgresql.org/support/security/
- http://www.debian.org/security/2012/dsa-2491
- http://www.securitytracker.com/id?1026995
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aab49e934de1fff046e659cbec46e3d053b41c34
- http://www.postgresql.org/docs/8.3/static/release-8-3-19.html
- http://www.postgresql.org/docs/8.4/static/release-8-4-12.html
- http://git.postgresql.org/gitweb/?p=postgresql.git&a=commit&h=932ded2ed51e8333852e370c7a6dad75d9f236f9
- http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
- http://support.apple.com/kb/HT5501
- http://rhn.redhat.com/errata/RHSA-2012-1037.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082294.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:092
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://www.postgresql.org/docs/9.0/static/release-9-0-8.html
- http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html
- http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html
- http://secunia.com/advisories/49304
- http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2012-2140
- GCVE · GCVE-0-2012-2143
Avis du CERT-FR
- CERTFR-2015-AVI-431 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTA-2012-AVI-512 — Multiples Vulnérabilités dans Apple OS X · cert.ssi.gouv.fr
- CERTA-2012-AVI-341 — Multiples vulnérabilités dans PHP · cert.ssi.gouv.fr
- CERTA-2012-AVI-311 — Vulnérabilité dans Check Point IPSO · cert.ssi.gouv.fr
- CERTA-2012-AVI-310 — Vulnérabilités dans PostgreSQL · cert.ssi.gouv.fr
- CERTA-2012-AVI-301 — Vulnérabilité dans FreeBSD · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*≥ 8.3 < 8.3.19cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*≥ 8.4 < 8.4.12cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*≥ 9.0 < 9.0.8cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*≥ 9.1 < 9.1.4cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*≤ 9.0cpe:2.3:o:freebsd:freebsd:1.0:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:1.1:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:1.1.5:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:1.1.5.1:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:2.0:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:2.0.5:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:2.1:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:2.1.5:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:2.1.6:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:2.1.7:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:2.2:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:2.2.1:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:2.2.2:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:2.2.5:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:2.2.6:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:2.2.7:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:2.2.8:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:3.0:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:3.1:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:3.2:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:3.3:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:3.4:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:3.5:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:4.0:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:4.1:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:4.1.1:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:4.2:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:4.3:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:4.4:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:4.5:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:4.6:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:4.6.2:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:4.7:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:4.8:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:4.9:*:*:*:*:*:*:*- +26 autres
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |