REDHAT-BUG-883719: Low severity mysql (mysql-common) vulnerability
A vulnerability was found in the handling of password salt values in MySQL. When a user logs into MySQL a salt value is generated that is then used to prevent password guessing attacks (since the salt value must be known in order to send a password). This salt value is created at the start of a session and used for the entire session, once authenticated an attacker can use the MySQL "changeuser" command to attempt to login as a different, as the salt value is known a password guessing attack will be much more efficient.
Reference: http://seclists.org/fulldisclosure/2012/Dec/58
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-883719?
REDHAT-BUG-883719 is considered a serious vulnerability due to its impact on password security in MySQL.
How do I fix REDHAT-BUG-883719?
To fix REDHAT-BUG-883719, ensure you are using the latest version of MySQL with the relevant security patches applied.
Who is affected by REDHAT-BUG-883719?
Users and administrators of MySQL Server are affected by REDHAT-BUG-883719 if they do not update their software.
What is the nature of the vulnerability in REDHAT-BUG-883719?
The nature of the vulnerability in REDHAT-BUG-883719 relates to the improper handling of password salt values, which compromises password guessing defenses.
When was REDHAT-BUG-883719 reported?
REDHAT-BUG-883719 was reported in December 2012.