CVE

Id
55560  
CVE No.
CVE-2012-2317  
Status
Candidate  
Description
The Debian php_crypt_revamped.patch patch for PHP 5.3.x, as used in the php5 package before 5.3.3-7+squeeze4 in Debian GNU/Linux squeeze, the php5 package before 5.3.2-1ubuntu4.17 in Ubuntu 10.04 LTS, and the php5 package before 5.3.5-1ubuntu7.10 in Ubuntu 11.04, does not properly handle an empty salt string, which might allow remote attackers to bypass authentication by leveraging an application that relies on the PHP crypt function to choose a salt for password hashing.  
Phase
Assigned (20120419)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
579677 55560 CVE-2012-2317 MLIST:[oss-security] 20120504 Debian/Ubuntu php_crypt_revamped.patch  View
579678 55560 CVE-2012-2317 URL:http://www.openwall.com/lists/oss-security/2012/05/04/7  View
579679 55560 CVE-2012-2317 MLIST:[oss-security] 20120505 Re: Debian/Ubuntu php_crypt_revamped.patch  View
579680 55560 CVE-2012-2317 URL:http://www.openwall.com/lists/oss-security/2012/05/05/2  View
579681 55560 CVE-2012-2317 CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=581170  View
579682 55560 CVE-2012-2317 UBUNTU:USN-1481-1  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
26763 JVNDB-2012-002470 ConnMan の dhcpv6_get_option 関数における整数オーバーフローの脆弱性 ConnMan の gdhcp/client.c 内の dhcpv6_get_option 関数には、整数オーバーフローの脆弱性が存在します。 CVE-2012-2322 55560 5 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002470.html  View