NetSight
IP …
high7.5Public exploit code

CVE-2002-1374

The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password.

Affected products

VendorProductAffected versions
OracleMysql
Versions 3.22.26, 3.22.27, 3.22.28, 3.22.29, 3.22.30, 3.22.32
Symantec VeritasNetbackup Advanced Reporter
Versions 3.4, 4.5, 4.5_fp1, 4.5_fp2, 4.5_fp3, 4.5_mp1
Symantec VeritasNetbackup Global Data Manager
Versions 4.5, 4.5_fp1, 4.5_fp2, 4.5_fp3, 4.5_mp1, 4.5_mp2

References