PT-2012-3820 · Oracle+4 · Mysql Server+4

Sergei Golubchik · Published 2012-06-26 · Updated 2014-02-21 · CVE-2012-2122

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 5.1.x through 5.1.62, 5.5.x through 5.5.23, and 5.6.x through 5.6.5 MariaDB versions 5.1.x through 5.1.61, 5.2.x through 5.2.11, 5.3.x through 5.3.5, and 5.5.x through 5.5.22

Description The issue allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value. This occurs when running in certain environments with certain implementations of the memcmp function.

Recommendations For Oracle MySQL versions 5.1.x through 5.1.62, update to version 5.1.63 or later. For Oracle MySQL versions 5.5.x through 5.5.23, update to version 5.5.24 or later. For Oracle MySQL versions 5.6.x through 5.6.5, update to version 5.6.6 or later. For MariaDB versions 5.1.x through 5.1.61, update to version 5.1.62 or later. For MariaDB versions 5.2.x through 5.2.11, update to version 5.2.12 or later. For MariaDB versions 5.3.x through 5.3.5, update to version 5.3.6 or later. For MariaDB versions 5.5.x through 5.5.22, update to version 5.5.23 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CESA-2012_1462

CVE-2012-2122

DSA-2496-1

OPENSUSE-SU-2012_0860-1

RHSA-2012:1462

RHSA-2012_1462

Affected Products

Centos

Mariadb

Mysql Server

Red Hat

Suse

References · 14

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/mysql/mysql_authbypass_hashdump.rb · Exploit
• 🔥 https://exploit-db.com/exploits/19092 · Exploit
• 🔥 http://exploit-db.com/exploits/19092 · Exploit
• 🔥 http://bugs.mysql.com/bug.php?id=64884 · Exploit
• 🔥 http://securityfocus.com/bid/53911 · Exploit
• 🔥 https://community.rapid7.com/community/metasploit/blog/2012/06/11/cve-2012-2122-a-tragically-comedic-security-flaw-in-mysql · Exploit
• http://secunia.com/advisories/49417 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2122 · Security Note
• http://security.gentoo.org/glsa/glsa-201308-06.xml · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00007.html · Vendor Advisory
• http://seclists.org/oss-sec/2012/q2/493 · Patch
• http://kb.askmonty.org/en/mariadb-5162-release-notes · Note
• http://securitytracker.com/id?1027143 · Note
• http://secunia.com/advisories/53372 · Note