Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2012-2122 | First vendor Publication | 2012-06-26 |
| Vendor | Cve | Last vendor Modification | 2014-02-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:H/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 5.1 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | High |
| Cvss Expoit Score | 4.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2122 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-287 | Improper Authentication |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:17885 | |||
| Oval ID: | oval:org.mitre.oval:def:17885 | ||
| Title: | USN-1467-1 -- mysql-5.1, mysql-5.5, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities | ||
| Description: | Several security issues were fixed in MySQL. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-1467-1 CVE-2012-2122 | Version: | 7 |
| Platform(s): | Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 | Product(s): | mysql-5.5 mysql-5.1 mysql-dfsg-5.1 mysql-dfsg-5.0 |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-12-26 | Name : Fedora Update for mysql FEDORA-2012-19823 File : nvt/gb_fedora_2012_19823_mysql_fc16.nasl |
| 2012-12-18 | Name : Fedora Update for mysql FEDORA-2012-19833 File : nvt/gb_fedora_2012_19833_mysql_fc17.nasl |
| 2012-12-13 | Name : SuSE Update for mysql openSUSE-SU-2012:0860-1 (mysql) File : nvt/gb_suse_2012_0860_1.nasl |
| 2012-08-30 | Name : Fedora Update for mysql FEDORA-2012-9308 File : nvt/gb_fedora_2012_9308_mysql_fc17.nasl |
| 2012-08-10 | Name : Debian Security Advisory DSA 2496-1 (mysql-5.1) File : nvt/deb_2496_1.nasl |
| 2012-06-28 | Name : Fedora Update for mysql FEDORA-2012-9324 File : nvt/gb_fedora_2012_9324_mysql_fc16.nasl |
| 2012-06-15 | Name : Ubuntu Update for mysql-5.5 USN-1467-1 File : nvt/gb_ubuntu_USN_1467_1.nasl |
| 2012-06-11 | Name : MySQL Authentication Bypass File : nvt/mysql_auth_bypas_cve_2012_2122.nasl |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | MySQL/MariaDB client authentication bypass attempt RuleID : 23115 - Revision : 8 - Type : SERVER-MYSQL |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-332.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-378.nasl - Type : ACT_GATHER_INFO |
| 2013-09-04 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2012-93.nasl - Type : ACT_GATHER_INFO |
| 2013-08-30 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201308-06.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-0180.nasl - Type : ACT_GATHER_INFO |
| 2013-01-25 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_libmysqlclient-devel-120731.nasl - Type : ACT_GATHER_INFO |
| 2013-01-24 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-0180.nasl - Type : ACT_GATHER_INFO |
| 2013-01-24 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20130122_mysql_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2013-01-23 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0180.nasl - Type : ACT_GATHER_INFO |
| 2012-08-02 | Name : The remote database server can be accessed without a valid password. File : mysql_auth_bypass.nasl - Type : ACT_ATTACK |
| 2012-06-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2496.nasl - Type : ACT_GATHER_INFO |
| 2012-06-27 | Name : The remote Fedora host is missing a security update. File : fedora_2012-9324.nasl - Type : ACT_GATHER_INFO |
| 2012-06-18 | Name : The remote Fedora host is missing a security update. File : fedora_2012-9308.nasl - Type : ACT_GATHER_INFO |
| 2012-06-12 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1467-1.nasl - Type : ACT_GATHER_INFO |
| 2012-06-11 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_1_63.nasl - Type : ACT_GATHER_INFO |
| 2012-06-11 | Name : The remote database server is affected by a security bypass vulnerability. File : mysql_5_5_24.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2021-05-04 12:19:45 |
|
| 2021-04-22 01:23:27 |
|
| 2020-05-23 00:33:31 |
|
| 2016-04-26 21:46:18 |
|
| 2014-06-14 13:32:51 |
|
| 2014-02-21 13:22:20 |
|
| 2014-02-17 11:09:54 |
|
| 2014-01-19 21:28:42 |
|
| 2013-10-11 13:23:59 |
|
| 2013-07-29 21:21:38 |
|
| 2013-05-10 22:38:24 |
|
