|
Security researchers have released details about a vulnerability inthe MySQL server that could allow potential attackers to accessMySQL databases without inputting proper authenticationcredentials. The vulnerability is identified as CVE-2012-2122 and was addressedin MySQL 5.1.63 and 5.5.25 in May. However, many server administrators might not be aware ofits impact, because the changelog for those versions contained verylittle information about the security bug. [ Discover what's new in business applications with InfoWorld's Technology: Applications newsletter. Keep up with the latest approaches to managing informationoverload and staying compliant in InfoWorld's interactive Data Explosion iGuide . ] The vulnerability can only be exploited if MySQL was built on asystem where the memcmp() function can return values outside the-128 to 127 range. This is the case for Linux systems that use anSSE-optimized glibc (GNU C library). If MySQL was built on such a system, the code that compares thecryptographic hash of a user-inputted password to the hash storedin the database for a particular account will sometimes allowauthentication even if the supplied password is incorrect. The probability of triggering this bug successfully on systems thatmeet the prerequisite is about 1 in 256, said Sergei Golubchik, thesecurity coordinator for MariaDB, in an email sent to the oss-sec mailing list on Saturday. "~300 attempts takesonly a fraction of second, so basically account password protectionis as good as nonexistent." MariaDB is a community-developed branch of MySQL that was alsoaffected by this vulnerability. The flaw was patched in MariaDBversions 5.1.62, 5.2.12, 5.3.6 and 5.5.23 back in April. A module for exploiting this vulnerability was added to the popularMetasploit penetration testing framework on Sunday. Afterexploiting the vulnerability, the module copies the MySQL server'smaster user table, which contains all password hashes. An attacker can crack the password hashes using dictionary attacksand maintain their unauthorized access on the server even if thisauthentication bypass vulnerability is later fixed. "If you areapproaching this issue from the perspective of a penetrationtester, this will be one of the most useful MySQL tricks for sometime to come," Metasploit chief architect HD Moore said in a blog post on Monday. Moore also published a list of Linux distributions for which olderMySQL builds were found to be vulnerable to this attack. Theseinclude 64-bit versions of Ubuntu 10.04, 10.10, 11.04, 11.10 and12.04, the 64-bit version of OpenSuSE 12.1, the 64-bit version ofthe Debian unstable branch, the 64-bit version of Fedora 16 and anunspecified version of Arch Linux. Most Linux vendors distribute pre-compiled MySQL builds throughtheir own repositories and patched builds should already beavailable for the most popular distributions. Users are advised toupgrade to non-vulnerable builds as soon as possible, especiallysince the exploit code for this vulnerability is now public. No official patch is available for MySQL 5.0.x, because thatversion of the database server is no longer supported by Oracle.However, some Linux vendors might backport the patch from MySQL 5.1or 5.5. We are high quality suppliers, our products such as 9W UV Lamp Manufacturer , UV Germicidal Lamps Manufacturer for oversee buyer. To know more, please visits Micro Needle Roller.
Related Articles -
9W UV Lamp Manufacturer, UV Germicidal Lamps Manufacturer,
|
