A serious security vulnerability found in MySQL/MariaDB
Summary
A critical security vulnerability has been discovered in MySQL/MariaDB, stemming from incorrect casting during password authentication. This flaw causes the database to incorrectly validate a user's password, even when the calculated token does not match the expected value. An attacker can exploit this by repeatedly attempting connections with any password, as the 1/256 probability of success per attempt makes brute-forcing trivial. This effectively renders account password protection nonexistent for affected versions, including all MariaDB and MySQL up to 5.1.61, 5.2.11, 5.3.5, and 5.5.22. Immediate patching is crucial for users running these vulnerable versions.
When a user connects to MariaDB/MySQL, a token (SHA over a password and a random scramble string) is calculated and compared with the expected value. Because of incorrect casting, it might've happened that the token and the expected value were considered equal, even if the memcmp() returned a non-zero value. In this case MySQL/MariaDB would think that the password is correct, even while it is not. Because the protocol uses random strings, the probability of hitting this bug is about 1/256.
Which means, if one knows a user name to connect (and "root" almost always exists), she can connect using *any* password by repeating connection attempts. ~300 attempts takes only a fraction of second, so basically account password protection is as good as nonexistent. Any client will do, there's no need for a special libmysqlclient library.
According to Sergei Golubchik, the affected MySQL/MariaDB version are All MariaDB and MySQL versions up to 5.1.61, 5.2.11, 5.3.5, 5.5.22.
For the detailed bug description and patches for the bug. Please visit SECLISTS.ORG. Hope people who are using the above mentioned MySQL/MariaDB versions to fix the bug as soon as possible.
No comment for this article.