CVE-2012-2143 Weak cryptography in n/a
A flaw in FreeBSD's DES-based crypt function allows attackers to bypass authentication using truncated passwords, potentially leading to unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-2143?
CVE-2012-2143 is a medium-severity vulnerability in Debian Debian Linux, published on 5 Jul 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.
Weakness: CWE-310
Which versions are affected by CVE-2012-2143?
It affects 4 products.
Linux distribution packages (24)
postgresql Red Hat:enterprise_linux:5::client | All versions | 0:8.1.23-5.el5_8 |
postgresql-contrib Red Hat:enterprise_linux:5::client | All versions | 0:8.1.23-5.el5_8 |
postgresql-debuginfo Red Hat:enterprise_linux:5::client | All versions | 0:8.1.23-5.el5_8 |
postgresql-docs Red Hat:enterprise_linux:5::client | All versions | 0:8.1.23-5.el5_8 |
postgresql-libs Red Hat:enterprise_linux:5::client | All versions | 0:8.1.23-5.el5_8 |
postgresql-python Red Hat:enterprise_linux:5::client | All versions | 0:8.1.23-5.el5_8 |
postgresql-tcl Red Hat:enterprise_linux:5::client | All versions | 0:8.1.23-5.el5_8 |
postgresql Red Hat:enterprise_linux:5::client_workstation | All versions | 0:8.1.23-5.el5_8 |
postgresql-debuginfo Red Hat:enterprise_linux:5::client_workstation | All versions | 0:8.1.23-5.el5_8 |
postgresql-devel Red Hat:enterprise_linux:5::client_workstation | All versions | 0:8.1.23-5.el5_8 |
postgresql-pl Red Hat:enterprise_linux:5::client_workstation | All versions | 0:8.1.23-5.el5_8 |
postgresql-server Red Hat:enterprise_linux:5::client_workstation | All versions | 0:8.1.23-5.el5_8 |
postgresql-test Red Hat:enterprise_linux:5::client_workstation | All versions | 0:8.1.23-5.el5_8 |
postgresql Red Hat:enterprise_linux:5::server | All versions | 0:8.1.23-5.el5_8 |
postgresql-contrib Red Hat:enterprise_linux:5::server | All versions | 0:8.1.23-5.el5_8 |
postgresql-debuginfo Red Hat:enterprise_linux:5::server | All versions | 0:8.1.23-5.el5_8 |
postgresql-devel Red Hat:enterprise_linux:5::server | All versions | 0:8.1.23-5.el5_8 |
postgresql-docs Red Hat:enterprise_linux:5::server | All versions | 0:8.1.23-5.el5_8 |
postgresql-libs Red Hat:enterprise_linux:5::server | All versions | 0:8.1.23-5.el5_8 |
postgresql-pl Red Hat:enterprise_linux:5::server | All versions | 0:8.1.23-5.el5_8 |
postgresql-python Red Hat:enterprise_linux:5::server | All versions | 0:8.1.23-5.el5_8 |
postgresql-server Red Hat:enterprise_linux:5::server | All versions | 0:8.1.23-5.el5_8 |
postgresql-tcl Red Hat:enterprise_linux:5::server | All versions | 0:8.1.23-5.el5_8 |
postgresql-test Red Hat:enterprise_linux:5::server | All versions | 0:8.1.23-5.el5_8 |
Products include Debian Debian Linux, Freebsd Freebsd, Php Php, Postgresql Postgresql.
How do I fix CVE-2012-2143?
Upgrade to a fixed version.
Is CVE-2012-2143 being exploited?
There is no known exploitation of CVE-2012-2143 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as GHSA-6rxj-38xv-j69g, RHSA-2012:1036.