CVE-2011-3189

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt argument instead of the hashed string, which might allow remote attackers to bypass authentication via an arbitrary password, a different vulnerability than CVE-2011-2483.

References

http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html

http://osvdb.org/74726

http://secunia.com/advisories/45678

http://support.apple.com/kb/HT5130

http://www.openwall.com/lists/oss-security/2011/08/23/4

http://www.php.net/archive/2011.php#id2011-08-23-1

http://www.php.net/ChangeLog-5.php#5.3.8

https://bugs.gentoo.org/show_bug.cgi?id=380261

https://bugs.php.net/bug.php?id=55439

https://exchange.xforce.ibmcloud.com/vulnerabilities/69429

Details

Source: MITRE

Published: 2011-08-25

Updated: 2017-08-29

Type: CWE-310

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:php:php:5.3.7:*:*:*:*:*:*:*

Tenable Plugins

View all (7 total)

IDNameProductFamilySeverity
58811HP System Management Homepage < 7.0 Multiple VulnerabilitiesNessusWeb Servers
critical
6303Mac OS X 10.7 < 10.7.3 Multiple VulnerabilitiesNessus Network MonitorGeneric
critical
57798Mac OS X Multiple Vulnerabilities (Security Update 2012-001) (BEAST)NessusMacOS X Local Security Checks
critical
57797Mac OS X 10.7.x < 10.7.3 Multiple Vulnerabilities (BEAST)NessusMacOS X Local Security Checks
critical
56459GLSA-201110-06 : PHP: Multiple vulnerabilitiesNessusGentoo Local Security Checks
critical
6017PHP 5.3.x < 5.3.7 crypt() MD5 Incorrect Return ValueNessus Network MonitorWeb Servers
high
55969PHP 5.3.7 crypt() MD5 Incorrect Return ValueNessusCGI abuses
high