CVE-2012-2122: Medium severity oracle mysql vulnerability

Published Jun 26, 2012

Updated

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.

Affected Software

61 affected components

ORACLE MySQL=5.1.51

ORACLE MySQL=5.1.52

ORACLE MySQL=5.1.52-sp1

ORACLE MySQL=5.1.53

ORACLE MySQL=5.1.54

ORACLE MySQL=5.1.55

ORACLE MySQL=5.1.56

ORACLE MySQL=5.1.57

ORACLE MySQL=5.1.58

ORACLE MySQL=5.1.59

ORACLE MySQL=5.1.60

ORACLE MySQL=5.1.61

ORACLE MySQL=5.5.10

ORACLE MySQL=5.5.11

ORACLE MySQL=5.5.12

ORACLE MySQL=5.5.13

ORACLE MySQL=5.5.14

ORACLE MySQL=5.5.15

ORACLE MySQL=5.5.16

ORACLE MySQL=5.5.17

ORACLE MySQL=5.5.18

ORACLE MySQL=5.5.19

ORACLE MySQL=5.5.20

ORACLE MySQL=5.5.21

ORACLE MySQL=5.6.2

ORACLE MySQL=5.6.3

ORACLE MySQL=5.6.4

ORACLE MySQL=5.6.5

MariaDB MariaDB=5.1.41

MariaDB MariaDB=5.1.42

MariaDB MariaDB=5.1.44

MariaDB MariaDB=5.1.47

MariaDB MariaDB=5.1.49

MariaDB MariaDB=5.1.50

MariaDB MariaDB=5.1.51

MariaDB MariaDB=5.1.53

MariaDB MariaDB=5.1.55

MariaDB MariaDB=5.1.60

MariaDB MariaDB=5.1.61

MariaDB MariaDB=5.2.0

MariaDB MariaDB=5.2.1

MariaDB MariaDB=5.2.2

MariaDB MariaDB=5.2.3

MariaDB MariaDB=5.2.4

MariaDB MariaDB=5.2.5

MariaDB MariaDB=5.2.6

MariaDB MariaDB=5.2.7

MariaDB MariaDB=5.2.8

MariaDB MariaDB=5.2.9

MariaDB MariaDB=5.2.10

MariaDB MariaDB=5.2.11

MariaDB MariaDB=5.3.0

MariaDB MariaDB=5.3.1

MariaDB MariaDB=5.3.2

MariaDB MariaDB=5.3.3

MariaDB MariaDB=5.3.4

MariaDB MariaDB=5.3.5

MariaDB MariaDB=5.3.6

MariaDB MariaDB=5.5.20

MariaDB MariaDB=5.5.21

MariaDB MariaDB=5.5.22

Remediation

Patch Available

http://seclists.org/oss-sec/2012/q2/493

Event History

Jun 26, 2012

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-2122?

CVE-2012-2122 has been classified with a moderate severity level.

How do I fix CVE-2012-2122?

To fix CVE-2012-2122, upgrade to MySQL versions 5.1.63, 5.5.24, 5.6.6 or later, or MariaDB versions 5.1.62, 5.2.12, 5.3.6, 5.5.23 or later.

Which versions of MySQL are affected by CVE-2012-2122?

MySQL versions 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6 are affected by CVE-2012-2122.

Which versions of MariaDB are impacted by CVE-2012-2122?

MariaDB versions 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23 are impacted by CVE-2012-2122.

What exploitation methods are available for CVE-2012-2122?

CVE-2012-2122 can be exploited remotely under certain conditions related to the implementation of the memcmp function.