MySQL Database Authentication Bypass

Publish date: September 15, 2016
  Severity: MEDIUM
  CVE Identifier: CVE-2012-2122

  DESCRIPTION

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.

  TREND MICRO PROTECTION INFORMATION

Apply associated Trend Micro DPI Rules.

  SOLUTION

  Trend Micro Deep Security DPI Rule Number: 1005045
  Trend Micro Deep Security DPI Rule Name: 1005045 - MySQL Database Server Possible Login Brute Force Attempt

  AFFECTED SOFTWARE AND VERSION

  • mariadb mariadb 5.1.41
  • mariadb mariadb 5.1.42
  • mariadb mariadb 5.1.44
  • mariadb mariadb 5.1.47
  • mariadb mariadb 5.1.49
  • mariadb mariadb 5.1.50
  • mariadb mariadb 5.1.51
  • mariadb mariadb 5.1.53
  • mariadb mariadb 5.1.55
  • mariadb mariadb 5.1.60
  • mariadb mariadb 5.1.61
  • mariadb mariadb 5.2.0
  • mariadb mariadb 5.2.1
  • mariadb mariadb 5.2.10
  • mariadb mariadb 5.2.11
  • mariadb mariadb 5.2.2
  • mariadb mariadb 5.2.3
  • mariadb mariadb 5.2.4
  • mariadb mariadb 5.2.5
  • mariadb mariadb 5.2.6
  • mariadb mariadb 5.2.7
  • mariadb mariadb 5.2.8
  • mariadb mariadb 5.2.9
  • mariadb mariadb 5.3.0
  • mariadb mariadb 5.3.1
  • mariadb mariadb 5.3.2
  • mariadb mariadb 5.3.3
  • mariadb mariadb 5.3.4
  • mariadb mariadb 5.3.5
  • mariadb mariadb 5.3.6
  • mariadb mariadb 5.5.20
  • mariadb mariadb 5.5.21
  • mariadb mariadb 5.5.22
  • oracle mysql 5.1.51
  • oracle mysql 5.1.52
  • oracle mysql 5.1.53
  • oracle mysql 5.1.54
  • oracle mysql 5.1.55
  • oracle mysql 5.1.56
  • oracle mysql 5.1.57
  • oracle mysql 5.1.58
  • oracle mysql 5.1.59
  • oracle mysql 5.1.60
  • oracle mysql 5.1.61
  • oracle mysql 5.5.10
  • oracle mysql 5.5.11
  • oracle mysql 5.5.12
  • oracle mysql 5.5.13
  • oracle mysql 5.5.14
  • oracle mysql 5.5.15
  • oracle mysql 5.5.16
  • oracle mysql 5.5.17
  • oracle mysql 5.5.18
  • oracle mysql 5.5.19
  • oracle mysql 5.5.20
  • oracle mysql 5.5.21
  • oracle mysql 5.6.2
  • oracle mysql 5.6.3
  • oracle mysql 5.6.4
  • oracle mysql 5.6.5

Featured Stories