|
MySQL COM_CHANGE_USER Password Length Account Compromise Vulnerability
A flaw in the password authentication mechanism for MySQL may make it possible for an authenticated database user to compromise the accounts of other database users. The flaw lies in the fact that the server uses a string returned by the client when the COM_CHANGE_USER command is issued to iterate through a comparison when attempting to authenticate the password. An attacker may authenticate as another database user if they can successfully guess the first character of the correct password for that user. The range of the valid character set for passwords is 32 characters, which means that a malicious user can authenticate after a maximum of 32 attempts if they cycle through all of the valid characters. This issue is related to the vulnerability described in Bugtraq ID 975. The problem was not sufficiently addressed in the COM_CHANGE_USER command. |
|
 Privacy Statement |
