Detections
Analytics

MySQL Zero-length Scrambled String Crafted Packet Authentication Bypass

high Nessus Plugin ID 17690

Language:

Synopsis

It is possible to bypass authentication on the remote database service.

Description

A bug in the version of MySQL running on the remote host allows a remote attacker to bypass the password authentication mechanism using a specially crafted packet with a zero-length scramble buff string.

An attacker with knowledge of an existing account defined to the affected service can leverage this vulnerability to bypass authentication and gain full access to that account.

Solution

Upgrade to MySQL 4.1.3 or later.

See Also

https://seclists.org/bugtraq/2004/Jul/45

http://dev.mysql.com/doc/refman/4.1/en/news-4-1-3.html

Plugin Details

Severity: High

ID: 17690

File Name: mysql_scramblebuff_len0_bypass.nasl

Version: 1.12

Type: remote

Family: Databases

Published: 1/7/2011

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.3

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:mysql:mysql

Excluded KB Items: global_settings/supplied_logins_only

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 6/28/2004

Vulnerability Publication Date: 7/1/2004

Exploitable With

CANVAS (CANVAS)

Reference Information

CVE: CVE-2004-0627

BID: 10654

CERT: 184030