Description
The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | postgresql-8.4 | 8.4.12-0squeeze1 | DSA-2491-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | php +25 | 5.3.3-14.el6_3 | RHSA-2012:1046 |
| RHEL 6 | postgresql +9 | 8.4.12-1.el6_2 | RHSA-2012:1037 |
| RHEL 5 | php53 +20 | 5.3.3-13.el5_8 | RHSA-2012:1047 |
| RHEL 5 | postgresql +9 | 8.1.23-5.el5_8 | RHSA-2012:1036 |
| RHEL 5 | postgresql84 +11 | 8.4.12-1.el5_8 | RHSA-2012:1037 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | postgresql93 | 9.3.15-1.1 | openSUSE-SU-2024:10256-1 |
| openSUSE Tumbleweed | postgresql94 | 9.4.10-1.1 | openSUSE-SU-2024:10030-1 |
| openSUSE Tumbleweed | postgresql95 | 9.5.4-1.2 | openSUSE-SU-2024:10273-1 |
Advisories 8
- RHSA-2012:1046 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:1047 Red Hat Security Advisory: php53 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:1036 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:1037 Red Hat Security Advisory: postgresql and postgresql84 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2491-1 postgresql-8.4 - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10030-1 postgresql94-9.4.10-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10273-1 libecpg6-32bit-9.5.4-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10256-1 postgresql93-9.3.15-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- http://www.postgresql.org/docs/9.1/static/release-9-1-4.html
- SUSE-SU-2012:0840 vendor-advisory
- FreeBSD-SA-12:02 vendor-advisory
- 50718 third-party-advisory
- FEDORA-2012-8924 vendor-advisory
- FEDORA-2012-8893 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=816956
- http://www.postgresql.org/support/security/
- DSA-2491 vendor-advisory
- 1026995 vdb-entry
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aab49e934de1fff046e659cbec46e3d053b41c34
- http://www.postgresql.org/docs/8.3/static/release-8-3-19.html
- http://www.postgresql.org/docs/8.4/static/release-8-4-12.html
- http://git.postgresql.org/gitweb/?p=postgresql.git&a=commit&h=932ded2ed51e8333852e370c7a6dad75d9f236f9
- APPLE-SA-2012-09-19-2 vendor-advisory
- http://support.apple.com/kb/HT5501
- RHSA-2012:1037 vendor-advisory
- FEDORA-2012-8915 vendor-advisory
- MDVSA-2012:092 vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://www.postgresql.org/docs/9.0/static/release-9-0-8.html
- openSUSE-SU-2012:1251 vendor-advisory
- openSUSE-SU-2012:1288 vendor-advisory
- 49304 third-party-advisory
- openSUSE-SU-2012:1299 vendor-advisory