PT-2012-3820 · Oracle+4 · Mysql Server+4
Sergei Golubchik
·
Publicado
2012-06-26
·
Atualizado
2014-02-21
·
CVE-2012-2122
CVSS v2.0
5.1
Média
| Vetor | AV:N/AC:H/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Oracle MySQL versions 5.1.x through 5.1.62, 5.5.x through 5.5.23, and 5.6.x through 5.6.5
MariaDB versions 5.1.x through 5.1.61, 5.2.x through 5.2.11, 5.3.x through 5.3.5, and 5.5.x through 5.5.22
Description
The issue allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value. This occurs when running in certain environments with certain implementations of the
memcmp function.Recommendations
For Oracle MySQL versions 5.1.x through 5.1.62, update to version 5.1.63 or later.
For Oracle MySQL versions 5.5.x through 5.5.23, update to version 5.5.24 or later.
For Oracle MySQL versions 5.6.x through 5.6.5, update to version 5.6.6 or later.
For MariaDB versions 5.1.x through 5.1.61, update to version 5.1.62 or later.
For MariaDB versions 5.2.x through 5.2.11, update to version 5.2.12 or later.
For MariaDB versions 5.3.x through 5.3.5, update to version 5.3.6 or later.
For MariaDB versions 5.5.x through 5.5.22, update to version 5.5.23 or later.
Exploit
Correção
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Mariadb
Mysql Server
Red Hat
Suse