NVD

Id
9873  
Name
CVE-2011-3189  
Description
The crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt argument instead of the hashed string, which might allow remote attackers to bypass authentication via an arbitrary password, a different vulnerability than CVE-2011-2483.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-07  
Published
2011-08-25  
Modified Date
2012-02-03  
Seq
2011-3189  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
56610 9873 CVE-2011-3189 APPLE-SA-2012-02-01-1  View
56611 9873 CVE-2011-3189 http://support.apple.com/kb/HT5130  View
56612 9873 CVE-2011-3189 [oss-security] 20110823 CVE assignment - PHP salt flaw CVE-2011-3189  View
56613 9873 CVE-2011-3189 http://www.php.net/archive/2011.php#id2011-08-23-1  View
56614 9873 CVE-2011-3189 http://www.php.net/ChangeLog-5.php#5.3.8  View
56615 9873 CVE-2011-3189 php-crypt-security-bypass(69429)  View
56616 9873 CVE-2011-3189 https://bugs.gentoo.org/show_bug.cgi?id=380261  View
56617 9873 CVE-2011-3189 https://bugs.php.net/bug.php?id=55439  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
31976 JVNDB-2011-002216 PHP の crypt 関数における認証を回避される脆弱性 PHP の crypt 関数は、MD5 ハッシュタイプが使用される時、ハッシュ文字列の代わりに salt 引数の値を返すため、認証を回避される脆弱性が存在します。 CVE-2011-3189 51096 CVE-2011-3189 9873 4.3 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-002216.html 2011-08-25 2011-09-15 View