mysql漏洞包_【我是来捧场的】MySQL部分版本出现用户登陆漏洞-CSDN博客

本文链接：https://blog.csdn.net/weixin_30093045/article/details/113631247

该楼层疑似违规已被系统折叠隐藏此楼查看此楼

MySQL部分版本出现用户登陆漏洞bug: Security vulnerability in MySQL/MariaDB sql/password.c

Security vulnerability in MySQL/MariaDB 在知道用户名的情况下(如root)，直接反复重试(平均大约256次)即可登入。

受影响的版本：

All MariaDB and MySQL versions up to 5.1.61, 5.2.11, 5.3.5, 5.5.22 are vulnerable.

MariaDB versions from 5.1.62, 5.2.12, 5.3.6, 5.5.23 are not.

MySQL versions from 5.1.63, 5.5.24, 5.6.6 are not. 补充说明:

这个 Bug 在官方编译的版本中没有发现。如果你是下载的源码，然后自己编译的就有可能遇到这个问题。

这个问题和 memcmp() 这个函数的返回值有关系。目前知道的情况来看，gcc 自带的 memcmp 是安全的，BSD libc 的 memcmp 是安全的。Linux glibc sse 优化过的 memcmp 会有这个问题。

---------------------------------------------------------------- 该mysql 漏洞利用的方法： #!/usr/bin/python

import subprocess

while 1:

subprocess.Popen("mysql -u root mysql --password=blah", shell=True).wait() 用这段python 代码即可检查 ---------------------------------------------------------------- From: http://seclists.org/oss-sec/2012/q2/493 We have recently found a serious security bug in MariaDB and MySQL.

So, here, we'd like to let you know about what the issue and its impact

is. At the end you can find a patch, in case you need to patch an older

unsuported MySQL version. All MariaDB and MySQL versions up to 5.1.61, 5.2.11, 5.3.5, 5.5.22 are

vulnerable.

MariaDB versions from 5.1.62, 5.2.12, 5.3.6, 5.5.23 are not.

MySQL versions from 5.1.63, 5.5.24, 5.6.6 are not. This issue got assigned an id CVE-2012-2122. Here's the issue. When a user connects to MariaDB/MySQL, a token (SHA

over a password and a random scramble string) is calculated and compared

with the expected value. Because of incorrect casting, it might've

happened that the token and the expected value were considered equal,

even if the memcmp() returned a non-zero value. In this case

MySQL/MariaDB would think that the password is correct, even while it is

not. Because the protocol uses random strings, the probability of

hitting this bug is about 1/256. Which means, if one knows a user name to connect (and "root" almost

always exists), she can connect using *any* password by repeating

connection attempts. ~300 attempts takes only a fraction of second, so

basically account password protection is as good as nonexistent.

Any client will do, there's no need for a special libmysqlclient library. But practically it's better than it looks - many MySQL/MariaDB builds

are not affected by this bug. Whether a particular build of MySQL or MariaDB is vulnerable, depends on