PHP 'crypt()' Function Security Bypass Vulnerability

Bugtraq ID:	49376
Class:	Input Validation Error
CVE:	CVE-2011-3189
Remote:	Yes
Local:	No
Published:	Aug 22 2011 12:00AM
Updated:	Mar 19 2015 08:32AM
Credit:	<br>Jo of feuersee.de
Vulnerable:	PHP PHP 5.3.7 PHP PHP 5.3.6 PHP PHP 5.3.5 PHP PHP 5.3.2 PHP PHP 5.3.1 PHP PHP 5.3 PHP PHP 5.3.5 PHP PHP 5.3.4 RC1 PHP PHP 5.3.4 PHP PHP 5.3.3 HP System Management Homepage 6.2.2 7 HP System Management Homepage 6.0 .96 HP System Management Homepage 3.0.2 .77 HP System Management Homepage 3.0.1 .73 HP System Management Homepage 3.0 .68 HP System Management Homepage 3.0 .64 HP System Management Homepage 6.3 HP System Management Homepage 6.2.0-12 HP System Management Homepage 6.2 HP System Management Homepage 6.2 HP System Management Homepage 6.1.0.103 HP System Management Homepage 6.1.0.102 HP System Management Homepage 6.1.0-103 HP System Management Homepage 6.1 HP System Management Homepage 6.0.0.95 HP System Management Homepage 6.0.0-95 HP System Management Homepage 6.0 HP System Management Homepage 3.0.2.77 B HP System Management Homepage 3.0.2-77 HP System Management Homepage 3.0.1-73 HP System Management Homepage 3.0.0-68 HP System Management Homepage 0 Apple Mac OS X Server 10.6.6 Apple Mac OS X Server 10.6.5 Apple Mac OS X Server 10.6.4 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac Os X Server 10.7.2 Apple Mac Os X Server 10.7.1 Apple Mac Os X Server 10.7 Apple Mac Os X Server 10.6.8 Apple Mac Os X Server 10.6.7 Apple Mac OS X Server 10.6 Apple Mac OS X 10.6.5 Apple Mac OS X 10.6.4 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac Os X 10.7.2 Apple Mac Os X 10.7.1 Apple Mac OS X 10.6
Not Vulnerable:	PHP PHP 5.3.8 HP System Management Homepage 7.0 Apple Mac Os X Server 10.7.3 Apple Mac Os X 10.7.3

PHP 'crypt()' Function Security Bypass Vulnerability

PHP is prone to a security-bypass vulnerability.

Successful exploits will allow an attackers to bypass certain security restrictions.

PHP 5.3.7 and prior are vulnerable.

PHP 'crypt()' Function Security Bypass Vulnerability

Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

PHP 'crypt()' Function Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.


Apple Mac OS X Server 10.6.8

• Apple SecUpdSrvr2012-001.dmg
  For Mac OS X Server v10.6.8
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.7.2

• Apple MacOSXUpd10.7.3.dmg
  For OS X Lion v10.7.2
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.7.1

• Apple MacOSXServerUpdCombo10.7.3.dmg
  For OS X Lion Server v10.7 and v10.7.1
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.8

• Apple SecUpd2012-001Snow.dmg
  For Mac OS X v10.6.8
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.7.2

• Apple MacOSXServerUpd10.7.3.dmg
  For OS X Lion Server v10.7.2
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.7.1

• Apple MacOSXUpdCombo10.7.3.dmg
  For OS X Lion v10.7 and v10.7.1
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.7

• Apple MacOSXServerUpdCombo10.7.3.dmg
  For OS X Lion Server v10.7 and v10.7.1
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.7

• Apple MacOSXUpdCombo10.7.3.dmg
  For OS X Lion v10.7 and v10.7.1
  http://www.apple.com/support/downloads/

PHP 'crypt()' Function Security Bypass Vulnerability

References:

• Bug #55439 crypt() returns only the salt for MD5 (PHP)
  
• PHP 5.3.8 Released! (PHP)
  
• PHP Homepage (PHP)