Trend Micro Security

MySQL Database Authentication Bypass

2016年9月15日
  危険度: : 中
  CVE識別番号: CVE-2012-2122

  概要

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.

  トレンドマイクロの対策

Apply associated Trend Micro DPI Rules.

  対応方法

  Trend Micro Deep Security DPI Rule Number: 1005045
  Trend Micro Deep Security DPI Rule Name: 1005045 - MySQL Database Server Possible Login Brute Force Attempt

  影響を受けるソフトウェア

  • mariadb mariadb 5.1.41
  • mariadb mariadb 5.1.42
  • mariadb mariadb 5.1.44
  • mariadb mariadb 5.1.47
  • mariadb mariadb 5.1.49
  • mariadb mariadb 5.1.50
  • mariadb mariadb 5.1.51
  • mariadb mariadb 5.1.53
  • mariadb mariadb 5.1.55
  • mariadb mariadb 5.1.60
  • mariadb mariadb 5.1.61
  • mariadb mariadb 5.2.0
  • mariadb mariadb 5.2.1
  • mariadb mariadb 5.2.10
  • mariadb mariadb 5.2.11
  • mariadb mariadb 5.2.2
  • mariadb mariadb 5.2.3
  • mariadb mariadb 5.2.4
  • mariadb mariadb 5.2.5
  • mariadb mariadb 5.2.6
  • mariadb mariadb 5.2.7
  • mariadb mariadb 5.2.8
  • mariadb mariadb 5.2.9
  • mariadb mariadb 5.3.0
  • mariadb mariadb 5.3.1
  • mariadb mariadb 5.3.2
  • mariadb mariadb 5.3.3
  • mariadb mariadb 5.3.4
  • mariadb mariadb 5.3.5
  • mariadb mariadb 5.3.6
  • mariadb mariadb 5.5.20
  • mariadb mariadb 5.5.21
  • mariadb mariadb 5.5.22
  • oracle mysql 5.1.51
  • oracle mysql 5.1.52
  • oracle mysql 5.1.53
  • oracle mysql 5.1.54
  • oracle mysql 5.1.55
  • oracle mysql 5.1.56
  • oracle mysql 5.1.57
  • oracle mysql 5.1.58
  • oracle mysql 5.1.59
  • oracle mysql 5.1.60
  • oracle mysql 5.1.61
  • oracle mysql 5.5.10
  • oracle mysql 5.5.11
  • oracle mysql 5.5.12
  • oracle mysql 5.5.13
  • oracle mysql 5.5.14
  • oracle mysql 5.5.15
  • oracle mysql 5.5.16
  • oracle mysql 5.5.17
  • oracle mysql 5.5.18
  • oracle mysql 5.5.19
  • oracle mysql 5.5.20
  • oracle mysql 5.5.21
  • oracle mysql 5.6.2
  • oracle mysql 5.6.3
  • oracle mysql 5.6.4
  • oracle mysql 5.6.5