5.1

CVE-2012-2122

Exploit
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Oracle ≫ Mysql Version5.1.51
Oracle ≫ Mysql Version5.1.52
Oracle ≫ Mysql Version5.1.52 Updatesp1
Oracle ≫ Mysql Version5.1.53
Oracle ≫ Mysql Version5.1.54
Oracle ≫ Mysql Version5.1.55
Oracle ≫ Mysql Version5.1.56
Oracle ≫ Mysql Version5.1.57
Oracle ≫ Mysql Version5.1.58
Oracle ≫ Mysql Version5.1.59
Oracle ≫ Mysql Version5.1.60
Oracle ≫ Mysql Version5.1.61
Oracle ≫ Mysql Version5.5.10
Oracle ≫ Mysql Version5.5.11
Oracle ≫ Mysql Version5.5.12
Oracle ≫ Mysql Version5.5.13
Oracle ≫ Mysql Version5.5.14
Oracle ≫ Mysql Version5.5.15
Oracle ≫ Mysql Version5.5.16
Oracle ≫ Mysql Version5.5.17
Oracle ≫ Mysql Version5.5.18
Oracle ≫ Mysql Version5.5.19
Oracle ≫ Mysql Version5.5.20
Oracle ≫ Mysql Version5.5.21
Oracle ≫ Mysql Version5.6.2
Oracle ≫ Mysql Version5.6.3
Oracle ≫ Mysql Version5.6.4
Oracle ≫ Mysql Version5.6.5
Mariadb ≫ Mariadb Version5.1.41
Mariadb ≫ Mariadb Version5.1.42
Mariadb ≫ Mariadb Version5.1.44
Mariadb ≫ Mariadb Version5.1.47
Mariadb ≫ Mariadb Version5.1.49
Mariadb ≫ Mariadb Version5.1.50
Mariadb ≫ Mariadb Version5.1.51
Mariadb ≫ Mariadb Version5.1.53
Mariadb ≫ Mariadb Version5.1.55
Mariadb ≫ Mariadb Version5.1.60
Mariadb ≫ Mariadb Version5.1.61
Mariadb ≫ Mariadb Version5.2.0
Mariadb ≫ Mariadb Version5.2.1
Mariadb ≫ Mariadb Version5.2.2
Mariadb ≫ Mariadb Version5.2.3
Mariadb ≫ Mariadb Version5.2.4
Mariadb ≫ Mariadb Version5.2.5
Mariadb ≫ Mariadb Version5.2.6
Mariadb ≫ Mariadb Version5.2.7
Mariadb ≫ Mariadb Version5.2.8
Mariadb ≫ Mariadb Version5.2.9
Mariadb ≫ Mariadb Version5.2.10
Mariadb ≫ Mariadb Version5.2.11
Mariadb ≫ Mariadb Version5.3.0
Mariadb ≫ Mariadb Version5.3.1
Mariadb ≫ Mariadb Version5.3.2
Mariadb ≫ Mariadb Version5.3.3
Mariadb ≫ Mariadb Version5.3.4
Mariadb ≫ Mariadb Version5.3.5
Mariadb ≫ Mariadb Version5.3.6
Mariadb ≫ Mariadb Version5.5.20
Mariadb ≫ Mariadb Version5.5.21
Mariadb ≫ Mariadb Version5.5.22
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 96.19% 0.999
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.1 4.9 6.4
AV:N/AC:H/Au:N/C:P/I:P/A:P
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://secunia.com/advisories/53372
http://security.gentoo.org/glsa/glsa-201308-06.xml
http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00007.html
http://bugs.mysql.com/bug.php?id=64884
Exploit
http://kb.askmonty.org/en/mariadb-5162-release-notes/
http://seclists.org/oss-sec/2012/q2/493
Patch
http://secunia.com/advisories/49417
Vendor Advisory
http://securitytracker.com/id?1027143
http://www.exploit-db.com/exploits/19092
http://www.securityfocus.com/bid/53911
Exploit
https://community.rapid7.com/community/metasploit/blog/2012/06/11/cve-2012-2122-a-tragically-comedic-security-flaw-in-mysql
Exploit