CVE-2012-5507: Race Condition

Q: What is the severity of CVE-2012-5507?

CVE-2012-5507 has been classified as a high severity vulnerability due to its ability to allow remote attackers to obtain sensitive password information.

Q: How do I fix CVE-2012-5507?

To mitigate CVE-2012-5507, you should upgrade to Zope version 2.13.19 or later, or Plone version 4.2.3 or later.

Q: Which software versions are affected by CVE-2012-5507?

CVE-2012-5507 affects Zope versions prior to 2.13.19 and Plone versions before 4.2.3.

Q: What kind of attack does CVE-2012-5507 enable?

CVE-2012-5507 enables remote attackers to exploit timing discrepancies during password validation attempts.

Q: Are there any known exploits for CVE-2012-5507?

While specific exploits for CVE-2012-5507 are not widely disclosed, the vulnerability allows attackers to deduce passwords under certain conditions.

Published Sep 30, 2014

Updated

AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.

Affected Software

102 affected componentsFixes available

pip/Plone>=4.3a1<=4.3a2

4.3b1

pip/Plone>=3.2.2<4.2.3

4.2.3

pip/Zope2<2.13.19

2.13.19

Zope Zope=2.5.1

Zope Zope=2.6.1

Zope Zope=2.6.4

Zope Zope=2.7.0

Zope Zope=2.7.3

Zope Zope=2.7.4

Zope Zope=2.7.5

Zope Zope=2.7.6

Zope Zope=2.7.7

Zope Zope=2.7.8

Zope Zope=2.8.1

Zope Zope=2.8.4

Zope Zope=2.8.6

Zope Zope=2.8.8

Zope Zope=2.9.2

Zope Zope=2.9.3

Zope Zope=2.9.4

Zope Zope=2.9.5

Zope Zope=2.9.6

Zope Zope=2.9.7

Zope Zope=2.10.3

Zope Zope=2.10.8

Zope Zope=2.11.0

Zope Zope=2.11.1

Zope Zope=2.11.2

Zope Zope=2.11.3

Zope Zope=2.13.18

Plone plone<=4.2.2

Plone plone=1.0

Plone plone=1.0.1

Plone plone=1.0.2

Plone plone=1.0.3

Plone plone=1.0.4

Plone plone=1.0.5

Plone plone=1.0.6

Plone plone=2.0

Plone plone=2.0.1

Plone plone=2.0.2

Plone plone=2.0.3

Plone plone=2.0.4

Plone plone=2.0.5

Plone plone=2.1

Plone plone=2.1.1

Plone plone=2.1.2

Plone plone=2.1.3

Plone plone=2.1.4

Plone plone=2.5

Plone plone=2.5.1

Plone plone=2.5.2

Plone plone=2.5.3

Plone plone=2.5.4

Plone plone=2.5.5

Plone plone=3.0

Plone plone=3.0.1

Plone plone=3.0.2

Plone plone=3.0.3

Plone plone=3.0.4

Plone plone=3.0.5

Plone plone=3.0.6

Plone plone=3.1

Plone plone=3.1.1

Plone plone=3.1.2

Plone plone=3.1.3

Plone plone=3.1.4

Plone plone=3.1.5.1

Plone plone=3.1.6

Plone plone=3.1.7

Plone plone=3.2

Plone plone=3.2.1

Plone plone=3.2.2

Plone plone=3.2.3

Plone plone=3.3

Plone plone=3.3.1

Plone plone=3.3.2

Plone plone=3.3.3

Plone plone=3.3.4

Plone plone=3.3.5

Plone plone=4.0

Plone plone=4.0.1

Plone plone=4.0.2

Plone plone=4.0.3

Plone plone=4.0.4

Plone plone=4.0.5

Plone plone=4.0.6.1

Plone plone=4.1

Plone plone=4.1.4

Plone plone=4.1.5

Plone plone=4.1.6

Plone plone=4.2

Plone plone=4.2-a1

Plone plone=4.2-a2

Plone plone=4.2-b1

Plone plone=4.2-b2

Plone plone=4.2-rc1

Plone plone=4.2-rc2

Plone plone=4.2.0.1

Plone plone=4.2.1

Plone plone=4.2.1.1

Plone plone=4.3

Remediation

Patch Available

https://plone.org/products/plone-hotfix/releases/20121106

Event History

Sep 30, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Jul 23, 2018

Advisory Published

via GitHub·07:51 PM

Frequently Asked Questions

What is the severity of CVE-2012-5507?

CVE-2012-5507 has been classified as a high severity vulnerability due to its ability to allow remote attackers to obtain sensitive password information.

How do I fix CVE-2012-5507?

To mitigate CVE-2012-5507, you should upgrade to Zope version 2.13.19 or later, or Plone version 4.2.3 or later.

Which software versions are affected by CVE-2012-5507?