MySQL Database Authentication Bypass

• Email
• Facebook
• 
  Twitter
• Google+
• Linkedin

  Severity: MEDIUM

  CVE Identifier: CVE-2012-2122

---

  DESCRIPTION

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.

  TREND MICRO PROTECTION INFORMATION

Apply associated Trend Micro DPI Rules.

  SOLUTION

  Trend Micro Deep Security DPI Rule Number: 1005045

  Trend Micro Deep Security DPI Rule Name: 1005045 - MySQL Database Server Possible Login Brute Force Attempt

  AFFECTED SOFTWARE AND VERSION

• mariadb mariadb 5.1.41
• mariadb mariadb 5.1.42
• mariadb mariadb 5.1.44
• mariadb mariadb 5.1.47
• mariadb mariadb 5.1.49
• mariadb mariadb 5.1.50
• mariadb mariadb 5.1.51
• mariadb mariadb 5.1.53
• mariadb mariadb 5.1.55
• mariadb mariadb 5.1.60
• mariadb mariadb 5.1.61
• mariadb mariadb 5.2.0
• mariadb mariadb 5.2.1
• mariadb mariadb 5.2.10
• mariadb mariadb 5.2.11
• mariadb mariadb 5.2.2
• mariadb mariadb 5.2.3
• mariadb mariadb 5.2.4
• mariadb mariadb 5.2.5
• mariadb mariadb 5.2.6
• mariadb mariadb 5.2.7
• mariadb mariadb 5.2.8
• mariadb mariadb 5.2.9
• mariadb mariadb 5.3.0
• mariadb mariadb 5.3.1
• mariadb mariadb 5.3.2
• mariadb mariadb 5.3.3
• mariadb mariadb 5.3.4
• mariadb mariadb 5.3.5
• mariadb mariadb 5.3.6
• mariadb mariadb 5.5.20
• mariadb mariadb 5.5.21
• mariadb mariadb 5.5.22
• oracle mysql 5.1.51
• oracle mysql 5.1.52
• oracle mysql 5.1.53
• oracle mysql 5.1.54
• oracle mysql 5.1.55
• oracle mysql 5.1.56
• oracle mysql 5.1.57
• oracle mysql 5.1.58
• oracle mysql 5.1.59
• oracle mysql 5.1.60
• oracle mysql 5.1.61
• oracle mysql 5.5.10
• oracle mysql 5.5.11
• oracle mysql 5.5.12
• oracle mysql 5.5.13
• oracle mysql 5.5.14
• oracle mysql 5.5.15
• oracle mysql 5.5.16
• oracle mysql 5.5.17
• oracle mysql 5.5.18
• oracle mysql 5.5.19
• oracle mysql 5.5.20
• oracle mysql 5.5.21
• oracle mysql 5.6.2
• oracle mysql 5.6.3
• oracle mysql 5.6.4
• oracle mysql 5.6.5