CVE-2012-2122: A Tragically Comedic Security Flaw in MySQL | Rapid7 Blog

Last updated at Sat, 16 Dec 2023 17:27:00 GMT Introduction On Saturday afternoon Sergei Golubchik posted to the oss-sec mailing list about a recently patched security flaw CVE-2012-2122in the MySQL and MariaDB database servers. This flaw was rooted in an assumption that the memcmp() function would always return a value within the range -128 to 127 (signed character). On some platforms and with cer

[todesking]

(；´Д｀)

[bluecrowp]

＞bashのワンライナー次は実際にパスワードを知らなくても、rootユーザーアカウントとして、影響を受けたMySQLサーバへのアクセスを提供します。

[tomo_ari]

これずっと試してるけど成功しない...

[matsumoto_r]

「there is a 1 in 256 chance that ANY password would be accepted for authentication.」

[oranie]

これは・・・。

[nyomonyomo]

リンク先英語で詳細読めてないけど、家のMySQLで試してみよう>RT MySQLのパスワードが間違えて居ても256分の1でとおってしまう

[kamipo]

"there is a 1 in 256 chance that ANY password would be accepted for authentication."

[yohei]

こわー

[uzulla]

Mysqlのごり押しログインワラタ、いや笑えない。／自分管理のシステムは影響ないっぽい

[ukky3]

CVE-2012-2122: A Tragically Comedic Security Flaw in MySQL