MySQL Unauthenticated Remote Access Vulnerability
BID:975
Info
MySQL Unauthenticated Remote Access Vulnerability
| Bugtraq ID: | 975 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 01 2000 12:00AM |
| Updated: | Feb 01 2000 12:00AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list on February 8, 2000 by Robert van der Meulen <[email protected]>. |
| Vulnerable: |
MySQL AB MySQL 3.23.10 MySQL AB MySQL 3.23.9 MySQL AB MySQL 3.23.8 MySQL AB MySQL 3.22.30 MySQL AB MySQL 3.22.29 MySQL AB MySQL 3.22.27 MySQL AB MySQL 3.22.26 |
| Not Vulnerable: |
MySQL AB MySQL 3.22.32 |
Discussion
MySQL Unauthenticated Remote Access Vulnerability
A vulnerability exists in the password verification scheme utilized by MySQL. This vulnerability will allow any user on a machine that has been granted access to connect to the database to connect as any user to that database. Instead of having to know an account name and password, the attacker need only know a legitimate account name. Versions from 3.22.26a and above are all vulnerable. Prior versions may too be vulnerable; this has not been confirmed.
The flaw lies in the fact that the server uses a string returned by the client to iterate through a comparison, without verifying the string it is using is of sufficient length.
while (*scrambled)
{
if (*scrambled++ != (char) (*to++ ^ extra))
return 1; /* Wrong password */
}
scrambled is a string returned by the client. If a user returns a single character as the value for the scrambled variable, only one byte will be compared to the expected password. So long as this one character matches, MySQL will authenticate the user, and allow them to access the database. According to details provided by the poster of this vulnerability, this will take at most 32 tries.
A vulnerability exists in the password verification scheme utilized by MySQL. This vulnerability will allow any user on a machine that has been granted access to connect to the database to connect as any user to that database. Instead of having to know an account name and password, the attacker need only know a legitimate account name. Versions from 3.22.26a and above are all vulnerable. Prior versions may too be vulnerable; this has not been confirmed.
The flaw lies in the fact that the server uses a string returned by the client to iterate through a comparison, without verifying the string it is using is of sufficient length.
while (*scrambled)
{
if (*scrambled++ != (char) (*to++ ^ extra))
return 1; /* Wrong password */
}
scrambled is a string returned by the client. If a user returns a single character as the value for the scrambled variable, only one byte will be compared to the expected password. So long as this one character matches, MySQL will authenticate the user, and allow them to access the database. According to details provided by the poster of this vulnerability, this will take at most 32 tries.
Exploit / POC
MySQL Unauthenticated Remote Access Vulnerability
x
x
Solution / Fix
MySQL Unauthenticated Remote Access Vulnerability
Solution:
Version 3.22.32 has been made available by the vendor at:
http://www.mysql.com/download_3.22.html
This version will fix the vulnerabilies outlined in this entry.
A fixed version of the 3.23.x tree (Alpha tree) will be available shortly.
FreeBSD has made fixed FreeBSD ports of mySQL available at:
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/databases/mysql-server-3.22.32.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-current/databases/mysql-server-3.22.32.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-current/databases/mysql-server-3.22.32.tgz
An unsupported patch was provided with the vulnerability posting:
Change the routine 'check_scramble' in mysql-3.22.26a/sql/password.c to do a
length check, _before_ starting the compare.
This should be as easy as inserting the following just above the
while (*scrambled) loop:
if (strlen(scrambled)!=strlen(to)) {
return 1;
}
Additional security can be achieved by only allowing essential hosts the ability to connect to the database server.
Solution:
Version 3.22.32 has been made available by the vendor at:
http://www.mysql.com/download_3.22.html
This version will fix the vulnerabilies outlined in this entry.
A fixed version of the 3.23.x tree (Alpha tree) will be available shortly.
FreeBSD has made fixed FreeBSD ports of mySQL available at:
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/databases/mysql-server-3.22.32.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-current/databases/mysql-server-3.22.32.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-current/databases/mysql-server-3.22.32.tgz
An unsupported patch was provided with the vulnerability posting:
Change the routine 'check_scramble' in mysql-3.22.26a/sql/password.c to do a
length check, _before_ starting the compare.
This should be as easy as inserting the following just above the
while (*scrambled) loop:
if (strlen(scrambled)!=strlen(to)) {
return 1;
}
Additional security can be achieved by only allowing essential hosts the ability to connect to the database server.