Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2012-2317

The Debian php_crypt_revamped.patch patch for PHP 5.3.x, as used in the php5 package before 5.3.3-7+squeeze4 in Debian GNU/Linux squeeze, the php5 package before 5.3.2-1ubuntu4.17 in Ubuntu 10.04 LTS, and the php5 package before 5.3.5-1ubuntu7.10 in Ubuntu 11.04, does not properly handle an empty salt string, which might allow remote attackers to bypass authentication by leveraging an application that relies on the PHP crypt function to choose a salt for password hashing.

Published

2012-08-07T19:55:01.437

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-310
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application debian php5-common ≤ 5.3.2-1 Yes
Application debian php5-common 5.3.3-7\+squeeze4 Yes
Operating System debian debian_linux * Yes
Application canonical php5 ≤ 5.3.2-1ubuntu4.16 Yes
Application canonical php5 5.3.2-1ubuntu4.17 Yes
Operating System canonical ubuntu_linux 10.04 Yes
Application canonical php5 ≤ 5.3.5-1ubuntu7.9 Yes
Application canonical php5 5.3.5-1ubuntu7.10 Yes
Operating System canonical ubuntu_linux 11.04 Yes
References