MySQL COM_CHANGE_USER command password authentication bypass
| mysql-comchangeuser-password-bypass (10847) |  High Risk |
Description:
MySQL could allow a remote or local attacker to bypass authentication and gain access to other user's accounts using any 1 byte password, caused by a vulnerability in the COM_CHANGE_USER command. A remote or local attacker with a valid MySQL account could use this vulnerability to gain access to any other user's account who logs into the MySQL database from the same host, including possibly the MySQL administrator's account.
Platforms Affected:
- Conectiva, Linux 6.0
- Conectiva, Linux 7.0
- Conectiva, Linux 8.0
- Debian, Debian Linux 2.2
- Debian, Debian Linux 3.0
- EngardeLinux, Secure Linux
- EngardeLinux, Secure Professional
- FreeBSD, FreeBSD
- Gentoo, Linux
- Immunix, Immunix OS 7+-beta
- MandrakeSoft, Mandrake Linux 7.2
- MandrakeSoft, Mandrake Linux 8.0
- MandrakeSoft, Mandrake Linux 8.0 PPC
- MandrakeSoft, Mandrake Linux 8.1
- MandrakeSoft, Mandrake Linux 8.1 IA64
- MandrakeSoft, Mandrake Linux 8.2 PPC
- MandrakeSoft, Mandrake Linux 8.2
- MandrakeSoft, Mandrake Linux 9.0
- MandrakeSoft, Mandrake Single Network Firewall 7.2
- MySQL, MySQL 3.22.26
- MySQL, MySQL 3.22.27
- MySQL, MySQL 3.22.28
- MySQL, MySQL 3.22.29
- MySQL, MySQL 3.22.30
- MySQL, MySQL 3.22.32
- MySQL, MySQL 3.23.10
- MySQL, MySQL 3.23.2
- MySQL, MySQL 3.23.23
- MySQL, MySQL 3.23.24
- MySQL, MySQL 3.23.25
- MySQL, MySQL 3.23.26
- MySQL, MySQL 3.23.27
- MySQL, MySQL 3.23.28
- MySQL, MySQL 3.23.29
- MySQL, MySQL 3.23.3
- MySQL, MySQL 3.23.30
- MySQL, MySQL 3.23.31
- MySQL, MySQL 3.23.34
- MySQL, MySQL 3.23.36
- MySQL, MySQL 3.23.37
- MySQL, MySQL 3.23.38
- MySQL, MySQL 3.23.39
- MySQL, MySQL 3.23.4
- MySQL, MySQL 3.23.40
- MySQL, MySQL 3.23.41
- MySQL, MySQL 3.23.42
- MySQL, MySQL 3.23.43
- MySQL, MySQL 3.23.44
- MySQL, MySQL 3.23.45
- MySQL, MySQL 3.23.46
- MySQL, MySQL 3.23.47
- MySQL, MySQL 3.23.48
- MySQL, MySQL 3.23.49
- MySQL, MySQL 3.23.5
- MySQL, MySQL 3.23.50
- MySQL, MySQL 3.23.51
- MySQL, MySQL 3.23.52
- MySQL, MySQL 3.23.53
- MySQL, MySQL 3.23.53a
- MySQL, MySQL 3.23.8
- MySQL, MySQL 3.23.9
- MySQL, MySQL 4.0.0
- MySQL, MySQL 4.0.1
- MySQL, MySQL 4.0.2
- MySQL, MySQL 4.0.3
- MySQL, MySQL 4.0.5A
- Novell, UnitedLinux 1.0
- OpenPKG, OpenPKG 1.0
- OpenPKG, OpenPKG 1.1
- OpenPKG, OpenPKG CURRENT
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Linux 7
- RedHat, Linux 7.1
- RedHat, Linux 7.1 for iSeries
- RedHat, Linux 7.1 for pSeries
- RedHat, Linux 7.2
- RedHat, Linux 7.3
- RedHat, Linux 8.0
- RedHat, Linux Advanced Workstation 2.1 Itanium
- SuSE, Linux Enterprise Server 8
- SuSE, SuSE Linux 7.1
- SuSE, SuSE Linux 7.2
- SuSE, SuSE Linux 7.3
- SuSE, SuSE Linux 8.0
- SuSE, SuSE Linux 8.1
- SuSE, SuSE Linux Connectivity Server
- SuSE, SuSE Linux Enterprise Server 7.0
- SuSE, SuSE Linux Office Server
- Trustix, Secure Linux 1.5
- Turbolinux, Turbolinux 7 Server
- Turbolinux, Turbolinux 7 Workstation
- Turbolinux, Turbolinux 8 Server
- Turbolinux, Turbolinux 8 Workstation
- Turbolinux, Turbolinux Advanced Server 6
- Turbolinux, Turbolinux Server 6.1
- Turbolinux, Turbolinux Server 6.5
Remedy:
Upgrade to the latest version of MySQL (3.23.54 or later), available from the MySQL Web site. See References.
For EnGarde Secure Linux Community Edition:
Upgrade to the latest MySQL package (3.23.36-1.0.20 or later), as listed in EnGarde Secure Linux Security Advisory 20021213-033. See References.
For Gentoo Linux:
Upgrade versions dev-db/mysql-3.23.53 and earlier, as listed in Gentoo Linux Security Announcement 200212-2.1. See References.
For OpenPKG:
Upgrade to the latest mysql package, as listed below. Refer to OpenPKG Security Advisory OpenPKG-SA-2002.013 for more information. See References.
OpenPKG 1.0: 3.23.46-1.0.1 or later
OpenPKG 1.1: 3.23.52-1.1.1 or later
OpenPKG CURRENT: 3.23.54-20021212 or later
For Conectiva Linux:
Upgrade to the latest MySQL package, as listed below. Refer to Conectiva Linux Announcement CLSA-2002:555 for more information. See References.
Conectiva Linux 6.0: 3.23.36-14U60_3cl or later
Conectiva Linux 7.0: 3.23.36-14U70_3cl or later
Conectiva Linux 8.0: 3.23.46-4U80_2cl or later
For Debian GNU/Linux:
Upgrade to the latest mysql package, as listed below. Refer to DSA-212-1 for more information. See References.
Debian GNU/Linux 2.2 (potato): 3.22.32-6.3 or later
Debian GNU/Linux 3.0 (woody): 3.23.49-8.2 or later
For Mandrake Linux:
Upgrade to the latest MySQL package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2002:087: MySQL for more information. See References.
Linux-Mandrake 7.2 and Single Network Firewall 7.2: 3.23.31-1.3mdk or later
Mandrake Linux 8.0: 3.23.36-2.2mdk or later
Mandrake Linux 8.1: 3.23.41-5.2mdk or later
Mandrake Linux 8.2: 3.23.47-5.2mdk or later
Mandrake Linux 9.0: 3.23.52-1.2mdk or later
For Trustix Secure Linux 1.5:
Upgrade to the latest MySQL package (3.23.54a-1tr or later), as listed in Trustix Secure Linux Security Advisory #2002-0086 for more information. See References.
For Red Hat Linux:
Upgrade to the latest my SQL package, as listed below. Refer to Red Hat Linux Security Advisory RHSA-2002:288-22 for more information. See References.
Red Hat 7.0: mysql-3.23.54a-3.70 or later
Red Hat 7.1: mysql-3.23.54a-3.71 or later
Red Hat 7.2: mysql-3.23.54a-3.72 or later
Red Hat 7.3: mysql-3.23.54a-3.73 or later
Red Hat 8.0: mysql-3.23.54a-4 or later
For TurboLinux Server 6.5, Advanced Server 6 and TurboLinux 7 and 8 (Server and Workstation):
Upgrade to the latest version of MySQL (3.23.52-3 or later), as listed in TurboLinux Security Announcement TLSA-2003-7. See References.
For Immunix OS 7+:
Upgrade to the latest version of mysql (3.23.54a-3.70_imnx_1 or later), as listed in Immunix OS Security Advisory IMNX-2003-7+-008-01. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Bypass Security
References:
- Conectiva Linux Announcement CLSA-2002:555, Several Vulnerabilities at http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000555.
- e-matters Security Advisory 04/2002, Multiple MySQL vulnerabilities at http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0106.html.
- EnGarde Secure Linux Security Advisory ESA-20021213-033, Several MySQL vulnerabilities. at http://www.linuxsecurity.com/content/view/104409/101/. (From LinuxSecurity archive)
- Gentoo Linux Security Announcement 200212-2.1, remote DOS and arbitrary code execution at http://archives.neohapsis.com/archives/bugtraq/2002-12/0138.html.
- Immunix OS Security Advisory IMNX-2003-7+-008-01, mysql at http://www.linuxsecurity.com/content/view/104896/105/. (From LinuxSecurity archive)
- MySQL Web site, Downloads for the 3.23 version at http://www.mysql.com/downloads/mysql-3.23.html.
- SecuriTeam Mailing List, Security Holes & Exploits 18 Jan 2003, Local and Remote Exploit for MySQL (Password Scrambling) at http://www.securiteam.com/exploits/5OP0G2A8UG.html.
- Trustix Secure Linux Security Advisory #2002-0086, mysql -- Multiple issues at http://www.trustix.net/errata/2002/0086/.
- VulnWatch Mailing List, Tue Jan 21 2003 - 19:03:41 CST, Multiple MySQL bugs at http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0031.html.
- BID-6373: MySQL COM_CHANGE_USER Password Length Account Compromise Vulnerability
- CVE-2002-1374: The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password.
- DSA-212: mysql -- multiple problems
- MDKSA-2002:087: Updated MySQL packages fix multiple vulnerabilities
- RHSA-2002-288: Updated MySQL packages fix various security issues
- RHSA-2002-289: mysql security update
- RHSA-2003-166: Updated MySQL packages fix vulnerabilities
- SUSE-SA:2003:003: mysql: remote command execution
Reported:
Dec 12, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net