CVE-2012-2143

The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 86%
Affected Products (NVD)
VendorProductVersion
postgresqlpostgresql
8.3 ≤
𝑥
< 8.3.19
postgresqlpostgresql
8.4 ≤
𝑥
< 8.4.12
postgresqlpostgresql
9.0 ≤
𝑥
< 9.0.8
postgresqlpostgresql
9.1 ≤
𝑥
< 9.1.4
freebsdfreebsd
𝑥
≤ 9.0
freebsdfreebsd
1.0
freebsdfreebsd
1.1
freebsdfreebsd
1.1.5
freebsdfreebsd
1.1.5.1
freebsdfreebsd
2.0
freebsdfreebsd
2.0.5
freebsdfreebsd
2.1
freebsdfreebsd
2.1.5
freebsdfreebsd
2.1.6
freebsdfreebsd
2.1.7
freebsdfreebsd
2.2
freebsdfreebsd
2.2.1
freebsdfreebsd
2.2.2
freebsdfreebsd
2.2.5
freebsdfreebsd
2.2.6
freebsdfreebsd
2.2.7
freebsdfreebsd
2.2.8
freebsdfreebsd
3.0
freebsdfreebsd
3.1
freebsdfreebsd
3.2
freebsdfreebsd
3.3
freebsdfreebsd
3.4
freebsdfreebsd
3.5
freebsdfreebsd
4.0
freebsdfreebsd
4.1
freebsdfreebsd
4.1.1
freebsdfreebsd
4.2
freebsdfreebsd
4.3
freebsdfreebsd
4.4
freebsdfreebsd
4.5
freebsdfreebsd
4.6
freebsdfreebsd
4.6.2
freebsdfreebsd
4.7
freebsdfreebsd
4.8
freebsdfreebsd
4.9
freebsdfreebsd
4.10
freebsdfreebsd
4.11
freebsdfreebsd
5.0
freebsdfreebsd
5.1
freebsdfreebsd
5.2
freebsdfreebsd
5.2.1
freebsdfreebsd
5.3
freebsdfreebsd
5.4
freebsdfreebsd
5.5
freebsdfreebsd
6.0
freebsdfreebsd
6.1
freebsdfreebsd
6.2
freebsdfreebsd
6.3
freebsdfreebsd
6.4
freebsdfreebsd
7.0
freebsdfreebsd
7.1
freebsdfreebsd
7.2
freebsdfreebsd
7.3
freebsdfreebsd
7.4
freebsdfreebsd
8.0
freebsdfreebsd
8.1
freebsdfreebsd
8.2
freebsdfreebsd
8.3
phpphp
𝑥
< 5.3.14
phpphp
5.4.0 ≤
𝑥
< 5.4.4
debiandebian_linux
6.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php5
hardy
not-affected
lucid
Fixed 5.3.2-1ubuntu4.17
released
maverick
ignored
natty
Fixed 5.3.5-1ubuntu7.10
released
oneiric
Fixed 5.3.6-13ubuntu3.8
released
precise
Fixed 5.3.10-1ubuntu3.2
released
quantal
not-affected
raring
not-affected
postgresql-8.2
hardy
ignored
lucid
dne
natty
dne
oneiric
dne
precise
dne
quantal
dne
raring
dne
postgresql-8.3
hardy
Fixed 8.3.19-0ubuntu8.04
released
lucid
dne
natty
dne
oneiric
dne
precise
dne
quantal
dne
raring
dne
postgresql-8.4
hardy
dne
lucid
Fixed 8.4.12-0ubuntu10.04
released
natty
Fixed 8.4.12-0ubuntu11.04
released
oneiric
ignored
precise
Fixed 8.4.17-0ubuntu12.04
released
quantal
dne
raring
dne
postgresql-9.1
hardy
dne
lucid
dne
natty
dne
oneiric
Fixed 9.1.4-0ubuntu11.10
released
precise
Fixed 9.1.4-0ubuntu12.04
released
quantal
not-affected
raring
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libecpg6
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
libpq5
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
libpq5-32bit
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
postgresql10
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
postgresql10-contrib
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
postgresql10-docs
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
postgresql10-plperl
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
postgresql10-plpython
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
postgresql10-pltcl
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
postgresql10-server
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
php
RHEL 6
0:5.3.3-14.el6_3
fixed
php-bcmath
RHEL 6
0:5.3.3-14.el6_3
fixed
php-cli
RHEL 6
0:5.3.3-14.el6_3
fixed
php-common
RHEL 6
0:5.3.3-14.el6_3
fixed
php-dba
RHEL 6
0:5.3.3-14.el6_3
fixed
php-devel
RHEL 6
0:5.3.3-14.el6_3
fixed
php-embedded
RHEL 6
0:5.3.3-14.el6_3
fixed
php-enchant
RHEL 6
0:5.3.3-14.el6_3
fixed
php-gd
RHEL 6
0:5.3.3-14.el6_3
fixed
php-imap
RHEL 6
0:5.3.3-14.el6_3
fixed
php-intl
RHEL 6
0:5.3.3-14.el6_3
fixed
php-ldap
RHEL 6
0:5.3.3-14.el6_3
fixed
php-mbstring
RHEL 6
0:5.3.3-14.el6_3
fixed
php-mysql
RHEL 6
0:5.3.3-14.el6_3
fixed
php-odbc
RHEL 6
0:5.3.3-14.el6_3
fixed
php-pdo
RHEL 6
0:5.3.3-14.el6_3
fixed
php-pgsql
RHEL 6
0:5.3.3-14.el6_3
fixed
php-process
RHEL 6
0:5.3.3-14.el6_3
fixed
php-pspell
RHEL 6
0:5.3.3-14.el6_3
fixed
php-recode
RHEL 6
0:5.3.3-14.el6_3
fixed
php-snmp
RHEL 6
0:5.3.3-14.el6_3
fixed
php-soap
RHEL 6
0:5.3.3-14.el6_3
fixed
php-tidy
RHEL 6
0:5.3.3-14.el6_3
fixed
php-xml
RHEL 6
0:5.3.3-14.el6_3
fixed
php-xmlrpc
RHEL 6
0:5.3.3-14.el6_3
fixed
php-zts
RHEL 6
0:5.3.3-14.el6_3
fixed
postgresql
RHEL 6
0:8.4.12-1.el6_2
fixed
postgresql-contrib
RHEL 6
0:8.4.12-1.el6_2
fixed
postgresql-devel
RHEL 6
0:8.4.12-1.el6_2
fixed
postgresql-docs
RHEL 6
0:8.4.12-1.el6_2
fixed
postgresql-libs
RHEL 6
0:8.4.12-1.el6_2
fixed
postgresql-plperl
RHEL 6
0:8.4.12-1.el6_2
fixed
postgresql-plpython
RHEL 6
0:8.4.12-1.el6_2
fixed
postgresql-pltcl
RHEL 6
0:8.4.12-1.el6_2
fixed
postgresql-server
RHEL 6
0:8.4.12-1.el6_2
fixed
postgresql-test
RHEL 6
0:8.4.12-1.el6_2
fixed
Common Weakness Enumeration
References
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aab49e934de1fff046e659cbec46e3d053b41c34
http://git.postgresql.org/gitweb/?p=postgresql.git&a=commit&h=932ded2ed51e8333852e370c7a6dad75d9f236f9
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082258.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082292.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082294.html
http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00003.html
http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html
http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html
http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html
http://rhn.redhat.com/errata/RHSA-2012-1037.html
http://secunia.com/advisories/49304
http://secunia.com/advisories/50718
http://security.freebsd.org/advisories/FreeBSD-SA-12:02.crypt.asc
http://support.apple.com/kb/HT5501
http://www.debian.org/security/2012/dsa-2491
http://www.mandriva.com/security/advisories?name=MDVSA-2012:092
http://www.postgresql.org/docs/8.3/static/release-8-3-19.html
http://www.postgresql.org/docs/8.4/static/release-8-4-12.html
http://www.postgresql.org/docs/9.0/static/release-9-0-8.html
http://www.postgresql.org/docs/9.1/static/release-9-1-4.html
http://www.postgresql.org/support/security/
http://www.securitytracker.com/id?1026995
https://bugzilla.redhat.com/show_bug.cgi?id=816956
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aab49e934de1fff046e659cbec46e3d053b41c34
http://git.postgresql.org/gitweb/?p=postgresql.git&a=commit&h=932ded2ed51e8333852e370c7a6dad75d9f236f9
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082258.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082292.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082294.html
http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00003.html
http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html
http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html
http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html
http://rhn.redhat.com/errata/RHSA-2012-1037.html
http://secunia.com/advisories/49304
http://secunia.com/advisories/50718
http://security.freebsd.org/advisories/FreeBSD-SA-12:02.crypt.asc
http://support.apple.com/kb/HT5501
http://www.debian.org/security/2012/dsa-2491
http://www.mandriva.com/security/advisories?name=MDVSA-2012:092
http://www.postgresql.org/docs/8.3/static/release-8-3-19.html
http://www.postgresql.org/docs/8.4/static/release-8-4-12.html
http://www.postgresql.org/docs/9.0/static/release-9-0-8.html
http://www.postgresql.org/docs/9.1/static/release-9-1-4.html
http://www.postgresql.org/support/security/
http://www.securitytracker.com/id?1026995
https://bugzilla.redhat.com/show_bug.cgi?id=816956