Published: 25/08/2011 Updated: 23/04/2024

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

crypt_blowfish prior to 1.1, as used in PHP prior to 5.3.7 on certain platforms, PostgreSQL prior to 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent malicious users to determine a cleartext password by leveraging knowledge of a password hash.

Vulnerable Product	Search on Vulmon	Subscribe to Product
php php
postgresql postgresql
openwall crypt blowfish

Debian Bug report logs - #631283 CVE-2011-2483 crypt_blowfish: 8-bit character mishandling allows different password pairs to produce the same hash Package: php5-suhosin; Maintainer for php5-suhosin is (unknown); Reported by: Luciano Bello <luciano@debianorg> Date: Wed, 22 Jun 2011 14:51:06 UTC Severity: serious Tags: sec ...

PostgreSQL incorrectly handled blowfish passwords ...

Several security issues were fixed in PHP ...

magnum discovered that the blowfish password hashing used amongst others in PostgreSQL contained a weakness that would give passwords with 8 bit characters the same hash as weaker equivalents For the oldstable distribution (lenny), this problem has been fixed in postgresql-83 version 8316-0lenny1 For the stable distribution (squeeze), this pro ...

Several vulnerabilities have been discovered in PHP, the web scripting language The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2011-1938 The UNIX socket handling allowed attackers to trigger a buffer overflow via a long path name CVE-2011-2483 The crypt_blowfish function did not properly handle 8-bit ...

A signedness issue was found in the way the crypt() function in the PostgreSQL pgcrypto module handled 8-bit characters in passwords when using Blowfish hashing Up to three characters immediately preceding a non-ASCII character (one with the high bit set) had no effect on the hash result, thus shortening the effective password length This made br ...

PHP before 537 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger a buffer overflow by leveraging the ability to provide an arbitrary value for a function argument, related ...

Portable password hashing framework for PHP. Uses the bcrypt and the SHA2 crypt() alternative schemes.

About Portable password hashing framework for PHP Originally inspired by phpass v03, hence the name PasswordHash2 However, it resembles none of the phpass framework If the crypt() does not implement the desired scheme, a pure PHP implementation is available My proposed SHA2 schemes are, well, proposed Unless they don't gain some traction, you won't see them impl

CWE-310 http://www.openwall.com/crypt/http://www.php.net/archive/2011.php#id2011-08-18-1 http://www.securityfocus.com/bid/49241 http://www.php.net/ChangeLog-5.php#5.3.7 http://php.net/security/crypt_blowfish http://freshmeat.net/projects/crypt_blowfish http://www.redhat.com/support/errata/RHSA-2011-1378.html http://www.postgresql.org/docs/8.4/static/release-8-4-9.html http://www.redhat.com/support/errata/RHSA-2011-1377.html http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00015.html http://www.ubuntu.com/usn/USN-1229-1 http://www.redhat.com/support/errata/RHSA-2011-1423.html http://www.mandriva.com/security/advisories?name=MDVSA-2011:165 http://www.mandriva.com/security/advisories?name=MDVSA-2011:180 http://www.mandriva.com/security/advisories?name=MDVSA-2011:179 http://www.mandriva.com/security/advisories?name=MDVSA-2011:178 http://www.debian.org/security/2011/dsa-2340 http://support.apple.com/kb/HT5130 http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://www.debian.org/security/2012/dsa-2399 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 https://exchange.xforce.ibmcloud.com/vulnerabilities/69319 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631283 https://usn.ubuntu.com/1229-1/https://nvd.nist.gov

CVE-2011-2483

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect