CVE-2012-2122

Description

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.

References

https://github.com/Ismael-Ifetayo/Security-Reports

https://github.com/NovocaineX/pentest-metasploit

https://github.com/Ateebshaikh21/red-team-ai

https://github.com/arshandrn/simulated-soc-nessus-snort

https://github.com/deepmaha2006/NetSentinel

https://github.com/netw0rk7/CVE-2012-2122-Home-Lab

https://github.com/subinyy/docker_CVE_2012_2122

https://github.com/minseo1021/cve_docker_hw

https://github.com/heane404/CVE_scan

https://github.com/Avinza/CVE-2012-2122-scanner

http://www.exploit-db.com/exploits/19092

http://securitytracker.com/id?1027143

http://security.gentoo.org/glsa/glsa-201308-06.xml

http://secunia.com/advisories/53372

http://secunia.com/advisories/49417

http://seclists.org/oss-sec/2012/q2/493

http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00007.html

http://kb.askmonty.org/en/mariadb-5162-release-notes/

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS