ID: IRCNE2012061520
Date: 2012-06-12
According to "computerworld", security researchers have released details about a vulnerability in the MySQL server that could allow potential attackers to access MySQL databases without inputting proper authentication credentials.
The vulnerability is identified as CVE-2012-2122 and was addressed in MySQL 5.1.63 and 5.5.25 in May. The vulnerability can only be exploited if MySQL was built on a system where the memcmp() function can return values outside the -128 to 127 range. This is the case for Linux systems that use an SSE-optimized glibc (GNU C library).
If MySQL was built on such a system, the code that compares the cryptographic hash of a user-inputted password to the hash stored in the database for a particular account will sometimes allow authentication even if the supplied password is incorrect.
The probability of triggering this bug successfully on systems that meet the prerequisite is about 1 in 256, said Sergei Golubchik, the security coordinator for MariaDB, in an email sent to the oss-sec mailing list on Saturday.
MariaDB is a community-developed branch of MySQL that was also affected by this vulnerability. The flaw was patched in MariaDB versions 5.1.62, 5.2.12, 5.3.6 and 5.5.23 back in April.
An attacker can crack the password hashes using dictionary attacks and maintain their unauthorized access on the server even if this authentication bypass vulnerability is later fixed. Moore published a list of Linux distributions for which older MySQL builds were found to be vulnerable to this attack. These include 64-bit versions of Ubuntu 10.04, 10.10, 11.04, 11.10 and 12.04, the 64-bit version of OpenSuSE 12.1, the 64-bit version of the Debian unstable branch, the 64-bit version of Fedora 16 and an unspecified version of Arch Linux.
Users are advised to upgrade to non-vulnerable builds as soon as possible, especially since the exploit code for this vulnerability is now public.
No official patch is available for MySQL 5.0.x, because that version of the database server is no longer supported by Oracle.
- 2