MySQL COM_CHANGE_USER command password authentication bypass
| mysql-comchangeuser-password-bypass (10847) |  High Risk |
Description:
MySQL could allow a remote or local attacker to bypass authentication and gain access to other user's accounts using any 1 byte password, caused by a vulnerability in the COM_CHANGE_USER command. A remote or local attacker with a valid MySQL account could use this vulnerability to gain access to any other user's account who logs into the MySQL database from the same host, including possibly the MySQL administrator's account.
Consequences:
Bypass Security
Remedy:
Upgrade to the latest version of MySQL (3.23.54 or later), available from the MySQL Web site. See References.
For EnGarde Secure Linux Community Edition:
Upgrade to the latest MySQL package (3.23.36-1.0.20 or later), as listed in EnGarde Secure Linux Security Advisory 20021213-033. See References.
For Gentoo Linux:
Upgrade versions dev-db/mysql-3.23.53 and earlier, as listed in Gentoo Linux Security Announcement 200212-2.1. See References.
For OpenPKG:
Upgrade to the latest mysql package, as listed below. Refer to OpenPKG Security Advisory OpenPKG-SA-2002.013 for more information. See References.
OpenPKG 1.0: 3.23.46-1.0.1 or later
OpenPKG 1.1: 3.23.52-1.1.1 or later
OpenPKG CURRENT: 3.23.54-20021212 or later
For Conectiva Linux:
Upgrade to the latest MySQL package, as listed below. Refer to Conectiva Linux Announcement CLSA-2002:555 for more information. See References.
Conectiva Linux 6.0: 3.23.36-14U60_3cl or later
Conectiva Linux 7.0: 3.23.36-14U70_3cl or later
Conectiva Linux 8.0: 3.23.46-4U80_2cl or later
For Debian GNU/Linux:
Upgrade to the latest mysql package, as listed below. Refer to DSA-212-1 for more information. See References.
Debian GNU/Linux 2.2 (potato): 3.22.32-6.3 or later
Debian GNU/Linux 3.0 (woody): 3.23.49-8.2 or later
For Mandrake Linux:
Upgrade to the latest MySQL package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2002:087: MySQL for more information. See References.
Linux-Mandrake 7.2 and Single Network Firewall 7.2: 3.23.31-1.3mdk or later
Mandrake Linux 8.0: 3.23.36-2.2mdk or later
Mandrake Linux 8.1: 3.23.41-5.2mdk or later
Mandrake Linux 8.2: 3.23.47-5.2mdk or later
Mandrake Linux 9.0: 3.23.52-1.2mdk or later
For Trustix Secure Linux 1.5:
Upgrade to the latest MySQL package (3.23.54a-1tr or later), as listed in Trustix Secure Linux Security Advisory #2002-0086 for more information. See References.
For Red Hat Linux:
Upgrade to the latest my SQL package, as listed below. Refer to Red Hat Linux Security Advisory RHSA-2002:288-22 for more information. See References.
Red Hat 7.0: mysql-3.23.54a-3.70 or later
Red Hat 7.1: mysql-3.23.54a-3.71 or later
Red Hat 7.2: mysql-3.23.54a-3.72 or later
Red Hat 7.3: mysql-3.23.54a-3.73 or later
Red Hat 8.0: mysql-3.23.54a-4 or later
For TurboLinux Server 6.5, Advanced Server 6 and TurboLinux 7 and 8 (Server and Workstation):
Upgrade to the latest version of MySQL (3.23.52-3 or later), as listed in TurboLinux Security Announcement TLSA-2003-7. See References.
For Immunix OS 7+:
Upgrade to the latest version of mysql (3.23.54a-3.70_imnx_1 or later), as listed in Immunix OS Security Advisory IMNX-2003-7+-008-01. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- Conectiva Linux Announcement CLSA-2002:555: Several Vulnerabilities.
- e-matters Security Advisory 04/2002: Multiple MySQL vulnerabilities .
- EnGarde Secure Linux Security Advisory ESA-20021213-033: Several MySQL vulnerabilities.. (From LinuxSecurity archive)
- Gentoo Linux Security Announcement 200212-2.1: remote DOS and arbitrary code execution.
- Immunix OS Security Advisory IMNX-2003-7+-008-01: mysql. (From LinuxSecurity archive)
- MySQL Web site: Downloads for the 3.23 version.
- SecuriTeam Mailing List, Security Holes & Exploits 18 Jan 2003: Local and Remote Exploit for MySQL (Password Scrambling) .
- Trustix Secure Linux Security Advisory #2002-0086: mysql -- Multiple issues.
- VulnWatch Mailing List, Tue Jan 21 2003 - 19:03:41 CST: Multiple MySQL bugs.
- BID-6373: MySQL COM_CHANGE_USER Password Length Account Compromise Vulnerability
- CVE-2002-1374: The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password.
- DSA-212: mysql -- multiple problems
- MDKSA-2002:087: Updated MySQL packages fix multiple vulnerabilities
- RHSA-2002-288: Updated MySQL packages fix various security issues
- RHSA-2002-289: mysql security update
- RHSA-2003-166: Updated MySQL packages fix vulnerabilities
- SUSE-SA:2003:003: mysql: remote command execution
Platforms Affected:
- Conectiva Linux 6.0
- Conectiva Linux 7.0
- Conectiva Linux 8.0
- Debian Debian Linux 2.2
- Debian Debian Linux 3.0
- EngardeLinux Secure Linux
- EngardeLinux Secure Professional
- FreeBSD FreeBSD
- Gentoo Linux
- Immunix Immunix OS 7+-beta
- MandrakeSoft Mandrake Linux 7.2
- MandrakeSoft Mandrake Linux 8.0
- MandrakeSoft Mandrake Linux 8.0 PPC
- MandrakeSoft Mandrake Linux 8.1
- MandrakeSoft Mandrake Linux 8.1 IA64
- MandrakeSoft Mandrake Linux 8.2
- MandrakeSoft Mandrake Linux 8.2 PPC
- MandrakeSoft Mandrake Linux 9.0
- MandrakeSoft Mandrake Single Network Firewall 7.2
- MySQL MySQL 3.22.26
- MySQL MySQL 3.22.27
- MySQL MySQL 3.22.28
- MySQL MySQL 3.22.29
- MySQL MySQL 3.22.30
- MySQL MySQL 3.22.32
- MySQL MySQL 3.23.10
- MySQL MySQL 3.23.2
- MySQL MySQL 3.23.23
- MySQL MySQL 3.23.24
- MySQL MySQL 3.23.25
- MySQL MySQL 3.23.26
- MySQL MySQL 3.23.27
- MySQL MySQL 3.23.28
- MySQL MySQL 3.23.29
- MySQL MySQL 3.23.3
- MySQL MySQL 3.23.30
- MySQL MySQL 3.23.31
- MySQL MySQL 3.23.34
- MySQL MySQL 3.23.36
- MySQL MySQL 3.23.37
- MySQL MySQL 3.23.38
- MySQL MySQL 3.23.39
- MySQL MySQL 3.23.4
- MySQL MySQL 3.23.40
- MySQL MySQL 3.23.41
- MySQL MySQL 3.23.42
- MySQL MySQL 3.23.43
- MySQL MySQL 3.23.44
- MySQL MySQL 3.23.45
- MySQL MySQL 3.23.46
- MySQL MySQL 3.23.47
- MySQL MySQL 3.23.48
- MySQL MySQL 3.23.49
- MySQL MySQL 3.23.5
- MySQL MySQL 3.23.50
- MySQL MySQL 3.23.51
- MySQL MySQL 3.23.52
- MySQL MySQL 3.23.53
- MySQL MySQL 3.23.53a
- MySQL MySQL 3.23.8
- MySQL MySQL 3.23.9
- MySQL MySQL 4.0.0
- MySQL MySQL 4.0.1
- MySQL MySQL 4.0.2
- MySQL MySQL 4.0.3
- MySQL MySQL 4.0.5A
- Novell SuSE Linux Enterprise Server 7.0
- Novell UnitedLinux 1.0
- OpenPKG OpenPKG 1.0
- OpenPKG OpenPKG 1.1
- OpenPKG OpenPKG CURRENT
- RedHat Enterprise Linux 2.1 AS
- RedHat Linux 7
- RedHat Linux 7.1
- RedHat Linux 7.1 for iSeries
- RedHat Linux 7.1 for pSeries
- RedHat Linux 7.2
- RedHat Linux 7.3
- RedHat Linux 8.0
- RedHat Linux Advanced Workstation 2.1 Itanium
- SuSE Linux Enterprise Server 8
- SUSE SuSE Linux 7.1
- SUSE SuSE Linux 7.2
- SUSE SuSE Linux 7.3
- SUSE SuSE Linux 8.0
- SUSE SuSE Linux 8.1
- SuSE SuSE Linux Connectivity Server
- SuSE SuSE Linux Office Server
- Trustix Secure Linux 1.5
- Turbolinux Turbolinux 7 Server
- Turbolinux Turbolinux 7 Workstation
- Turbolinux Turbolinux 8 Server
- Turbolinux Turbolinux 8 Workstation
- Turbolinux Turbolinux Advanced Server 6
- Turbolinux Turbolinux Server 6.1
- Turbolinux Turbolinux Server 6.5
Reported:
Dec 12, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net