CVE-2012-5627: Medium severity oracle mysql vulnerability
A vulnerability was found in the handling of password salt values in MySQL. When a user logs into MySQL a salt value is generated that is then used to prevent password guessing attacks (since the salt value must be known in order to send a password). This salt value is created at the start of a session and used for the entire session, once authenticated an attacker can use the MySQL "changeuser" command to attempt to login as a different, as the salt value is known a password guessing attack will be much more efficient.
Reference: http://seclists.org/fulldisclosure/2012/Dec/58
Other sources
Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the changeuser command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5627?
CVE-2012-5627 is considered a medium severity vulnerability due to its potential impact on password security.
How do I fix CVE-2012-5627?
To fix CVE-2012-5627, upgrade to a version of MySQL or MariaDB that is above the affected versions specified in the vulnerability report.
Which versions of MySQL are affected by CVE-2012-5627?
CVE-2012-5627 affects MySQL versions from 5.5.0 to 5.5.29.
What types of attacks does CVE-2012-5627 mitigate against?
CVE-2012-5627 helps mitigate password guessing attacks by using salt values during user logins.
Are MariaDB versions also affected by CVE-2012-5627?
Yes, MariaDB versions from 5.2.0 to 5.5.29, as well as specific versions of 10.0.0, are affected by CVE-2012-5627.