PT-2013-1815 · Oracle+1 · Mysql Server+2

Huzaifa S. Sidhpurwala · Published 2013-01-30 · Updated 2024-06-15 · CVE-2012-5627

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle MySQL and MariaDB versions 5.2.x through 5.2.13 Oracle MySQL and MariaDB versions 5.3.x through 5.3.11 Oracle MySQL and MariaDB versions 5.5.x through 5.5.28

Description The issue makes it easier for remote authenticated users to conduct brute force password guessing attacks because the salt is not modified during multiple executions of the change user command within the same connection.

Recommendations For Oracle MySQL and MariaDB versions 5.2.x through 5.2.13, update to version 5.2.14 or later. For Oracle MySQL and MariaDB versions 5.3.x through 5.3.11, update to version 5.3.12 or later. For Oracle MySQL and MariaDB versions 5.5.x through 5.5.28, update to version 5.5.29 or later.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

AZL-6692

CVE-2012-5627

OPENSUSE-SU-2024:10153-1

SUSE-RU-2023:3956-1

SUSE-RU-2023:4991-1

Affected Products

Mariadb

Mariadb Server

Mysql Server

References · 438

• 🔥 http://seclists.org/fulldisclosure/2012/Dec/58 · Exploit
• 🔥 https://exploit-db.com/exploits/38109 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2012/Dec/83 · Exploit
• https://bugzilla.redhat.com/show_bug.cgi?id=883719 · Patch
• https://osv.dev/vulnerability/SUSE-RU-2023:4991-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:102 · Vendor Advisory
• https://ubuntu.com/security/CVE-2012-5627 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10153-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-6692 · Vendor Advisory
• https://mariadb.atlassian.net/browse/MDEV-3915 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5627 · Security Note
• https://cve.org/CVERecord?id=CVE-2012-5627 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-5627 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-RU-2023:3956-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2022-24051 · Note