MySQL vulnerability allows attackers to bypass password verification

Exploit code is available for a MySQL authentication bypass vulnerability

Security researchers have released details about a vulnerability in the MySQL server that could allow potential attackers to access MySQL databases without inputting proper authentication credentials.

The vulnerability is identified as CVE-2012-2122 and was addressed in MySQL 5.1.63 and 5.5.25 in May. However, many server administrators might not be aware of its impact, because the changelog for those versions contained very little information about the security bug.

The vulnerability can only be exploited if MySQL was built on a system where the memcmp() function can return values outside the -128 to 127 range. This is the case for Linux systems that use an SSE-optimized glibc (GNU C library).

If MySQL was built on such a system, the code that compares the cryptographic hash of a user-inputted password to the hash stored in the database for a particular account will sometimes allow authentication even if the supplied password is incorrect.

The probability of triggering this bug successfully on systems that meet the prerequisite is about 1 in 256, said Sergei Golubchik, the security coordinator for MariaDB, in an email sent to the oss-sec mailing list on Saturday. "~300 attempts takes only a fraction of second, so basically account password protection is as good as nonexistent."

MariaDB is a community-developed branch of MySQL that was also affected by this vulnerability. The flaw was patched in MariaDB versions 5.1.62, 5.2.12, 5.3.6 and 5.5.23 back in April.

A module for exploiting this vulnerability was added to the popular Metasploit penetration testing framework on Sunday. After exploiting the vulnerability, the module copies the MySQL server's master user table, which contains all password hashes.

An attacker can crack the password hashes using dictionary attacks and maintain their unauthorized access on the server even if this authentication bypass vulnerability is later fixed. "If you are approaching this issue from the perspective of a penetration tester, this will be one of the most useful MySQL tricks for some time to come," Metasploit chief architect HD Moore said in a blog post on Monday.

Moore also published a list of Linux distributions for which older MySQL builds were found to be vulnerable to this attack. These include 64-bit versions of Ubuntu 10.04, 10.10, 11.04, 11.10 and 12.04, the 64-bit version of OpenSuSE 12.1, the 64-bit version of the Debian unstable branch, the 64-bit version of Fedora 16 and an unspecified version of Arch Linux.

Most Linux vendors distribute pre-compiled MySQL builds through their own repositories and patched builds should already be available for the most popular distributions. Users are advised to upgrade to non-vulnerable builds as soon as possible, especially since the exploit code for this vulnerability is now public.

No official patch is available for MySQL 5.0.x, because that version of the database server is no longer supported by Oracle. However, some Linux vendors might backport the patch from MySQL 5.1 or 5.5.

Vulnerabilities in some Netgear router and NAS products open door to remote attacks

READ THIS ARTICLE
DO NOT SHOW THIS BOX AGAIN [ x ]
Comments are now closed.
CSO Corporate Partners
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Security Solutions-GigaVUE-420

In partnership, Newgen provides innovative network monitoring and security solutions based upon Gigamon’s GigaVUE-420 systems.

Latest Jobs
Security Awareness Tip

Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).


  1. Have an incident response plan.

  2. Pre-define your incident response team 

  3. Define your approach: watch and learn or contain and recover.

  4. Pre-distribute call cards.

  5. Forensic and incident response data capture.

  6. Get your users on-side.

  7. Know how to report crimes and engage law enforcement. 

  8. Practice makes perfect.

For the full breakdown on this article

Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.