Description
The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://marc.info/?l=bugtraq&m=103971644013961&w=2 ↗
- http://marc.info/?l=bugtraq&m=104005886114500&w=2 ↗
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000555 ↗
- http://www.linuxsecurity.com/advisories/engarde_advisory-2660.html ↗
- http://security.e-matters.de/advisories/042002.html ↗
- http://www.debian.org/security/2002/dsa-212 ↗
- http://www.redhat.com/support/errata/RHSA-2002-288.html ↗
- http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:087 ↗
- http://www.redhat.com/support/errata/RHSA-2003-166.html ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/10847 ↗
- http://marc.info/?l=bugtraq&m=104004857201968&w=2 ↗
- http://www.novell.com/linux/security/advisories/2003_003_mysql.html ↗
- http://www.redhat.com/support/errata/RHSA-2002-289.html ↗
- http://www.trustix.net/errata/misc/2002/TSL-2002-0086-mysql.asc.txt ↗
- http://www.securityfocus.com/bid/6373 ↗
- http://www.securityfocus.com/advisories/5269 ↗