NetSight
IP …
medium4.0Public exploit code

CVE-2012-5627

Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_us…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks.

Affected products

VendorProductAffected versions
OracleMysql
from 5.5.0 before 5.5.29
MariadbMariadb
from 5.2.0 before 5.2.14
from 5.3.0 before 5.3.12
from 5.5.0 before 5.5.29
Version 10.0.0

Weakness classification

CWE-522

References