Summary
This host is running PHP and is prone to security bypass vulnerability.
Impact
Successful exploitation could allow remote attackers to bypass authentication via an arbitrary password.
Impact Level: Application
Solution
Upgrade to PHP version 5.3.8 or later.
For updates refer to http://www.php.net/downloads.php
Insight
The flaw is due to an error in 'crypt()' function which returns the salt value instead of hash value when executed with MD5 hash, which allows attacker to bypass authentication via an arbitrary password.
Affected
PHP version 5.3.7
References
Severity
Classification
-
CVE CVE-2011-3189 -
CVSS Base Score: 4.3
AV:N/AC:M/Au:N/C:P/I:N/A:N
Related Vulnerabilities
- Apache Traffic Server Remote DNS Cache Poisoning Vulnerability
- Apple Safari Multiple Memory Corruption Vulnerabilities-01 Aug14 (Mac OS X)
- Apple Safari Multiple Vulnerabilities
- Apple Safari Webcore Webkit 'XSSAuditor.cpp' XSS Vulnerability (Windows)
- Apple iTunes Tutorials Window Security Bypass Vulnerability (Mac OS X)