PT-2011-4300 · Php · Php

Agostino Sarubbo · Publicado 2011-08-25 · Atualizado 2017-08-29 · CVE-2011-3189

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP version 5.3.7

Description The issue in PHP allows remote attackers to potentially bypass authentication by providing an arbitrary password. This occurs because the crypt function returns the salt argument value instead of the hashed string when the MD5 hash type is used.

Recommendations For PHP version 5.3.7, consider updating to a newer version that addresses this issue, as the current version may allow attackers to bypass authentication using an arbitrary password. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2011-3189

Produtos afetados

Php

Referências · 13

• 🔥 https://bugs.php.net/bug.php?id=55439 · Exploit
• http://support.apple.com/kb/HT5130 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3189 · Nota
• http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html · Aviso do Fabricante
• http://secunia.com/advisories/45678 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/69429 · Nota
• http://osvdb.org/74726 · Nota
• http://php.net/ChangeLog-5.php#5.3.8 · Nota
• https://bugs.gentoo.org/show_bug.cgi?id=380261 · Nota
• http://openwall.com/lists/oss-security/2011/08/23/4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-3189 · Nota de Segurança
• http://xforce.iss.net/xforce/xfdb/69429 · Nota
• http://php.net/archive/2011.php#id2011-08-23-1 · Nota