Security Simple authentication bypass for MySQL root revealed

[J65nko]

From http://h-online.com/-1614990

Exploits for a recently revealed MySQL authentication bypass flaw are now in the wild, partly because the flaw is remarkably simple to exploit in order to gain root access to the database. The only mitigating factor appears to be that it depends on the C library that the MySQL database was built with. The bypass, assigned the vulnerability ID CVE-2012-2122, allows an attacker to gain root access by repeatedly trying to login with an incorrect password. Each attempt has a 1 in 256 chance of being given access. The exploits are mostly variations of looping through connecting to MySQL with a bad password around 300 to 512 times.

[Carpetsmoker]

Yikes!

As I understand it, you can check this with a simple script:

#!/bin/sh

for i in $(jot 2000); do
        mysql -u root --password=wrong -h mysql_machine
done

To be sure, I checked a few CentOS 5.x machines and a FreeBSD 8 machine, none were vulnerable.

Bonus hint: firewall!

[J65nko]

At http://pastie.org/4064638 is a C program for testing whether the memcmp function is vulnerable.