CVE-2012-2317
Medium
Description
The Debian php_crypt_revamped.patch patch for PHP 5.3.x, as used in the php5 package before 5.3.3-7+squeeze4 in Debian GNU/Linux squeeze, the php5 package before 5.3.2-1ubuntu4.17 in Ubuntu 10.04 LTS, and the php5 package before 5.3.5-1ubuntu7.10 in Ubuntu 11.04, does not properly handle an empty salt string, which might allow remote attackers to bypass authentication by leveraging an application that relies on the PHP crypt function to choose a salt for password hashing.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Debian Linux
PublishedAug 7, 2012
First seenAug 7, 2012
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian debian_linux | No range specified | — |
| debian php5-common | v ≤ 5.3.2-1, 5.3.3-7\+squeeze4 | — |
| canonical php5 | v ≤ 5.3.2-1ubuntu4.16, 5.3.2-1ubuntu4.17, v ≤ 5.3.5-1ubuntu7.9, 5.3.5-1ubuntu7.10 | — |
| canonical ubuntu_linux | 10.04, 11.04 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.