NVD

Id
43990  
Name
CVE-2012-2143  
Description
The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2012-07-05  
Modified Date
2016-12-07  
Seq
2012-2143  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
221102 43990 CVE-2012-2143 http://git.php.net/?p=php-src.git;a=commit;h=aab49e934de1fff046e659cbec46e3d053b41c34  View
221103 43990 CVE-2012-2143 http://git.postgresql.org/gitweb/?p=postgresql.git&a=commit&h=932ded2ed51e8333852e370c7a6dad75d9f236f9  View
221104 43990 CVE-2012-2143 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705  View
221105 43990 CVE-2012-2143 APPLE-SA-2012-09-19-2  View
221106 43990 CVE-2012-2143 FEDORA-2012-8893  View
221107 43990 CVE-2012-2143 FEDORA-2012-8924  View
221108 43990 CVE-2012-2143 FEDORA-2012-8915  View
221109 43990 CVE-2012-2143 SUSE-SU-2012:0840  View
221110 43990 CVE-2012-2143 openSUSE-SU-2012:1251  View
221111 43990 CVE-2012-2143 openSUSE-SU-2012:1288  View
221112 43990 CVE-2012-2143 openSUSE-SU-2012:1299  View
221113 43990 CVE-2012-2143 RHSA-2012:1037  View
221114 43990 CVE-2012-2143 FreeBSD-SA-12:02  View
221115 43990 CVE-2012-2143 http://support.apple.com/kb/HT5501  View
221116 43990 CVE-2012-2143 DSA-2491  View
221117 43990 CVE-2012-2143 MDVSA-2012:092  View
221118 43990 CVE-2012-2143 http://www.postgresql.org/docs/8.3/static/release-8-3-19.html  View
221119 43990 CVE-2012-2143 http://www.postgresql.org/docs/8.4/static/release-8-4-12.html  View
221120 43990 CVE-2012-2143 http://www.postgresql.org/docs/9.0/static/release-9-0-8.html  View
221121 43990 CVE-2012-2143 http://www.postgresql.org/docs/9.1/static/release-9-1-4.html  View
221122 43990 CVE-2012-2143 http://www.postgresql.org/support/security/  View
221123 43990 CVE-2012-2143 1026995  View
221124 43990 CVE-2012-2143 https://bugzilla.redhat.com/show_bug.cgi?id=816956  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
27315 JVNDB-2012-003022 FreeBSD の crypt_des 関数におけるアクセス権を取得される脆弱性 PHP、PostgreSQL、および他の製品で使用される FreeBSD の crypt_des 関数は、0x80 文字を含んだ平文パスワードを適切に処理しないため、アクセス権を取得される脆弱性が存在します。 CVE-2012-2143 55381 CVE-2012-2143 43990 4.3 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-003022.html 2012-05-30 2014-02-13 View