PT-2012-1227 · Freebsd+6 · Freebsd+5

Joseph Bonneau + 1 · Published 2012-06-25 · Updated 2024-06-15 · CVE-2012-2143

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions prior to 9.0-RELEASE-p2

Description The issue is related to the crypt des function, which does not process the complete cleartext password if it contains a 0x80 character. This makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password. The problem is demonstrated by a Unicode password and affects products that use this function, such as PHP and PostgreSQL.

Recommendations For FreeBSD versions prior to 9.0-RELEASE-p2, update to version 9.0-RELEASE-p2 or later to resolve the issue. As a temporary workaround, consider avoiding the use of passwords containing the 0x80 character until a patch is available. Restrict access to authentication mechanisms that rely on the crypt des function to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

BDU:2022-02629

CESA-2012_1037

CESA-2012_1046

CVE-2012-2143

DSA-2491-1

OPENSUSE-SU-2024:10030-1

OPENSUSE-SU-2024:10256-1

OPENSUSE-SU-2024:10273-1

RHSA-2012:1036

RHSA-2012:1037

RHSA-2012:1046

RHSA-2012:1047

RHSA-2012_1036

RHSA-2012_1037

RHSA-2012_1046

RHSA-2012_1047

SUSE-SU-2012_0840-1

SUSE-SU-2012_1021-1

Affected Products

Centos

Freebsd

Php

Postgresql

Red Hat

Suse

References · 163

• https://linux.oracle.com/errata/ELSA-2012-1037.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082294.html · Vendor Advisory
• http://postgresql.org/docs/8.4/static/release-8-4-12.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02629 · Security Note
• http://postgresql.org/support/security · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2655 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00003.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10030-1 · Vendor Advisory
• http://debian.org/security/2012/dsa-2491 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2335 · Security Note
• https://bdu.fstec.ru/vul/2022-02622 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082292.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html · Vendor Advisory