Overview
There is a vulnerability in the password authentication mechanism of MySQL which could allow an attacker to bypass authentication by supplying a zero-length string.
Description
MySQL is an open-source database system available for Microsoft Windows, Linux, and other UNIX-based operating systems. There is a vulnerability in the check_scramble_323() function that could allow an attacker to bypass authentication by supplying a "passwd_len" value of NULL. It has been reported that versions 4.1 prior to 4.1.3 and version 5.0 are affected. Note: In order to exploit this vulnerability, an attacker would have to use a modified MySQL client library. |
Impact
A remote, unauthenticated attacker with network access to the MySQL server could successfully authenticate without knowledge of the user's password. |
Solution
Upgrade |
|
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This vulnerability was reported by Chris Anley of NGSSoftware.
This document was written by Damon Morda.
Other Information
| CVE IDs: | CVE-2004-0627 |
| Severity Metric: | 5.74 |
| Date Public: | 2004-07-01 |
| Date First Published: | 2004-07-12 |
| Date Last Updated: | 2004-07-12 20:55 UTC |
| Document Revision: | 26 |