← back
CVE-2012-5627

CVE-2012-5627

EPSS 11.4%
Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks.
Affected products
n/a · n/a
public PoCs found — 1
exploitdbwww.exploit-db.com/exploits/38109unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://bugzilla.redhat.com/show_bug.cgi?id=883719http://seclists.org/fulldisclosure/2012/Dec/58http://seclists.org/fulldisclosure/2012/Dec/83http://seclists.org/oss-sec/2012/q4/424http://secunia.com/advisories/53372http://security.gentoo.org/glsa/glsa-201308-06.xmlhttps://mariadb.atlassian.net/browse/MDEV-3915http://www.mandriva.com/security/advisories?name=MDVSA-2013:102