CVEvulnerability

CVE-2012-2317

4.3 MEDIUM Published 2012-08-07 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2012-08-07
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-310

Description

The Debian php_crypt_revamped.patch patch for PHP 5.3.x, as used in the php5 package before 5.3.3-7+squeeze4 in Debian GNU/Linux squeeze, the php5 package before 5.3.2-1ubuntu4.17 in Ubuntu 10.04 LTS, and the php5 package before 5.3.5-1ubuntu7.10 in Ubuntu 11.04, does not properly handle an empty salt string, which might allow remote attackers to bypass authentication by leveraging an application that relies on the PHP crypt function to choose a salt for password hashing.

Affected configurations

• debian php5-common (<= 5.3.2-1) • debian php5-common 5.3.3-7\+squeeze4 • debian debian linux • canonical php5 (<= 5.3.2-1ubuntu4.16) • canonical php5 5.3.2-1ubuntu4.17 • canonical ubuntu linux 10.04 • canonical php5 (<= 5.3.5-1ubuntu7.9) • canonical php5 5.3.5-1ubuntu7.10 • canonical ubuntu linux 11.04

Related

Weakness · not in database (1)

References