MySQL unauthenticated remote access
| mysql-remote-access (4228) |  High Risk |
Description:
MySQL could allow remote attackers to bypass authentication. Insufficient password checking in MySQL may allow database access to any remote attacker that knows a valid username and can connect to the MySQL server.
Platforms Affected:
- FreeBSD, FreeBSD
- MySQL, MySQL 3.22.26
- MySQL, MySQL 3.22.27
- MySQL, MySQL 3.22.29
- MySQL, MySQL 3.22.30
- MySQL, MySQL 3.23.10
- MySQL, MySQL 3.23.8
- MySQL, MySQL 3.23.9
Remedy:
Upgrade to the latest version of MySQL (3.22.32 or later), appropriate for your platform. See References.
Consequences:
Gain Access
References:
- BugTraq Mailing List, Mon Feb 14 2000 - 09:37:45 CST, MySQL 3.22.32 released at http://archives.neohapsis.com/archives/bugtraq/2000-02/0111.html.
- BugTraq Mailing List, Tue Feb 08 2000 - 13:03:32 CST, Remote access vulnerability in all MySQL server versions at http://archives.neohapsis.com/archives/bugtraq/2000-02/0053.html.
- Caldera International, Inc. Security Advisory CSSA-2000-003.0, MySQL remote access vulnerability at ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2000-003.0.txt.
- FreeBSD Security Advisory FreeBSD-SA-00:05, MySQL allows bypassing of password authentication at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:05-mysql.asc.
- MySQL Web site, Downloads at http://www.mysql.com/downloads/index.html.
- SuSE Security Announcement #40, mysql < 3.22.30 at http://www.suse.de/de/security/suse_security_announce_40.txt.
- TurboLinux Security Announcement TLSA2000006-01, MySQL-3.22.27-5 and earlier at http://www.linuxtoday.com/news_story.php3?ltsn=2000-03-10-021-04-SC.
- BID-975: MySQL Unauthenticated Remote Access Vulnerability
- CVE-2000-0148: MySQL 3.22 allows remote attackers to bypass password authentication and access a database via a short check string.
Reported:
Feb 08, 2000
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net