CVE-2012-3287

Poul-Henning Kamp md5crypt has insufficient algorithmic complexity and a consequently short runtime, which makes it easier for context-dependent attackers to discover cleartext passwords via a brute-force attack, as demonstrated by an attack using GPU hardware.

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2012-06-13

Last modified

2024-09-16

Weaknesses

CWE-310

Affected products

• Md5crypt (Poul-henning Kamp)

References

• http://phk.freebsd.dk/sagas/md5crypt_eol.html
• https://phk.freebsd.dk/sagas/md5crypt_eol/