SB2012070511 - Amazon Linux AMI update for mysql55 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2012070511

SB2012070511 - Amazon Linux AMI update for mysql55

Published: July 5, 2012

Security Bulletin ID SB2012070511
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper Authentication (CVE-ID: CVE-2012-2122)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.


Remediation

Install update from vendor's website.

References