MySQL Authentication Bypass Vulnerability
BID:10654
Info
MySQL Authentication Bypass Vulnerability
| Bugtraq ID: | 10654 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 05 2004 12:00AM |
| Updated: | Jul 05 2004 12:00AM |
| Credit: | Discovery is credited to Chris Anley. |
| Vulnerable: |
MySQL AB MySQL 5.0 .0-alpha MySQL AB MySQL 5.0 .0-0 MySQL AB MySQL 4.1.2 -alpha MySQL AB MySQL 4.1.0.0-alpha MySQL AB MySQL 4.1.0-0 |
| Not Vulnerable: |
MySQL AB MySQL 4.1.3 -beta MySQL AB MySQL 4.1.3 -0 |
Discussion
MySQL Authentication Bypass Vulnerability
MySQL is prone to a vulnerability that may permit remote clients to bypass authentication.
This is due to a logic error in the server when handling client-supplied length values for password strings.
Successful exploitation will yield unauthorized access to the database.
This issue is known to exist in MySQL 4.1 releases prior to 4.1.3 and MySQL 5.0.
MySQL is prone to a vulnerability that may permit remote clients to bypass authentication.
This is due to a logic error in the server when handling client-supplied length values for password strings.
Successful exploitation will yield unauthorized access to the database.
This issue is known to exist in MySQL 4.1 releases prior to 4.1.3 and MySQL 5.0.
Exploit / POC
MySQL Authentication Bypass Vulnerability
The researchers who discovered this vulnerability have developed working exploit code that is not publicly available or known to be circulating in the wild.
A proof of concept exploit has been provided by Eli Kara <[email protected]>.
A diff file designed for patching the MySQL 5.0.0 alpha source has been provided by [email protected]. Once patched the malicious client will be able to authenticate to the vulnerable server by providing no password and a valid username.
The researchers who discovered this vulnerability have developed working exploit code that is not publicly available or known to be circulating in the wild.
A proof of concept exploit has been provided by Eli Kara <[email protected]>.
A diff file designed for patching the MySQL 5.0.0 alpha source has been provided by [email protected]. Once patched the malicious client will be able to authenticate to the vulnerable server by providing no password and a valid username.
Solution / Fix
MySQL Authentication Bypass Vulnerability
Solution:
This issue has been addressed in MySQL 4.1.3 releases. Recent builds of 5.0 reportedly also address this issue, but users are advised to contact the vendor for further details.
MySQL AB MySQL 4.1.0.0-alpha
MySQL AB MySQL 4.1.0-0
MySQL AB MySQL 4.1.2 -alpha
Solution:
This issue has been addressed in MySQL 4.1.3 releases. Recent builds of 5.0 reportedly also address this issue, but users are advised to contact the vendor for further details.
MySQL AB MySQL 4.1.0.0-alpha
-
MySQL AB MySQL 4.1.3
http://dev.mysql.com/downloads/mysql/4.1.html
MySQL AB MySQL 4.1.0-0
-
MySQL AB MySQL 4.1.3
http://dev.mysql.com/downloads/mysql/4.1.html
MySQL AB MySQL 4.1.2 -alpha
-
MySQL AB MySQL 4.1.3
http://dev.mysql.com/downloads/mysql/4.1.html
References
MySQL Authentication Bypass Vulnerability
References:
References:
- Hackproofing MySQL (NGSSoftware)
- MySQL Authentication Bypass / buffer overflow (NGSSoftware)