| Package | Affected versions | Patched versions |
|---|---|---|
| php | ≥ 5.4.0, < 5.4.4< 5.3.14 | 5.4.45.3.14 |
| postgresql | ≥ 8.3, < 8.3.19≥ 8.4, < 8.4.12≥ 9.0, < 9.0.8≥ 9.1, < 9.1.4 | 8.3.198.4.129.0.89.1.4 |
The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free