NVD

Id
43971  
Name
CVE-2012-2122  
Description
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.  
Reject
 
CVSS Version
2  
CVSS Score
5.1  
Severity
Medium  
CVSS Base Score
5.1  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2012-06-26  
Modified Date
2014-02-20  
Seq
2012-2122  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
220946 43971 CVE-2012-2122 http://bugs.mysql.com/bug.php?id=64884  View
220947 43971 CVE-2012-2122 http://kb.askmonty.org/en/mariadb-5162-release-notes/  View
220948 43971 CVE-2012-2122 SUSE-SU-2012:0984  View
220949 43971 CVE-2012-2122 [oss-security] 20120609 Security vulnerability in MySQL/MariaDB sql/password.c  View
220950 43971 CVE-2012-2122 GLSA-201308-06  View
220951 43971 CVE-2012-2122 1027143  View
220952 43971 CVE-2012-2122 19092  View
220953 43971 CVE-2012-2122 53911  View
220954 43971 CVE-2012-2122 https://community.rapid7.com/community/metasploit/blog/2012/06/11/cve-2012-2122-a-tragically-comedic-security-flaw-in-mysql  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
27188 JVNDB-2012-002895 Oracle MySQL および MariaDB の sql/password.c における認証を回避される脆弱性 Oracle MySQL および MariaDB の sql/password.c は、memcmp 関数の特定の実装を含む特定の環境で稼働する場合、認証を回避される脆弱性が存在します。 CVE-2012-2122 55360 CVE-2012-2122 43971 5.1 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002895.html 2012-06-26 2012-10-22 View