31–40 of 116 posts
Just tried the various one-liners mentioned in the comments on a hardy (8.04) release using mysql 5.0.51a and could not get in. This is a slicehost box, so I'm assuming that can be extrapolated to mean that anyone using ubuntu on slicehost is probably safe.
Just tried the various one-liners mentioned in the comments on a hardy (8.04) release using mysql 5.0.51a and could not get in. This is a slicehost box, so I'm assuming that can be extrapolated to mean that anyone using ubuntu on slicehost is probably safe.
This is a vulnerability in the authentication scheme used in the MySQL wire protocol, meaning attackers need to be able to connect to your MySQL database directly to exploit it. Attackers should never, ever be able to connect directly to your MySQL database directly . If you can connect to your MySQL instance directly from your Macbook in your living room, fix it right now .
―Attackers should never, ever be able to connect directly to your MySQL database directly. mySQLgame[1] demonstrates that domain logic can be successfully implemented within a publicly accessible database[2]. It would be better to reword your statement to: Minimise the attack surface by preventing unnecessary access There are times where public access to a database server make perfect sense. It is the reason why data…
Earlier quoted context omitted.
Well, the Ubuntu part came from HD Moore [1]. I haven't been able to confirm it on my Ubuntu 12.04 virtual machine instance though, nor does my virtual machine appear to trigger the bug using the CVE-2012-2122 checker [2]. But, that is just my single VM instance and I would assume HD Moore knows what he is doing. [1] http://pastie.org/private/903voijkkz8nmde3yqj4rw [2] http://pastie.org/4064638
I can confirm. Ubuntu 12.04 LTS (64 bit).
However tests of trying to brute force the root password using the mysql one liners in this thread have failed every time.
Both machines allow local access only so I assume I'm safe.
So if I try logging in with phpmyadmin 256 times, will I succeed?
If you roll a dice 6 times, will one result be a 6?
This is a vulnerability in the authentication scheme used in the MySQL wire protocol, meaning attackers need to be able to connect to your MySQL database directly to exploit it. Attackers should never, ever be able to connect directly to your MySQL database directly . If you can connect to your MySQL instance directly from your Macbook in your living room, fix it right now .
This is a vulnerability in the authentication scheme used in the MySQL wire protocol, meaning attackers need to be able to connect to your MySQL database directly to exploit it. Attackers should never, ever be able to connect directly to your MySQL database directly . If you can connect to your MySQL instance directly from your Macbook in your living room, fix it right now .
I've been trying this on lots of our customers' boxes and can't exploit it - no matter how many times I've tried I always get turned away when retrying root's password, e.g. trying "while true; do mysql -u root mysql --password=baha; done" does not yield access on any of: Debian lenny 32-bit 5.0.51a-24+lenny5 Debian lenny 64-bit 5.0.51a-24+lenny5 Debian lenny 64-bit 5.1.51-1-log Debian squeeze 64-bit 5.1.49-3-log Deb…
I would imagine you have to try a different password each time.
This is a vulnerability in the authentication scheme used in the MySQL wire protocol, meaning attackers need to be able to connect to your MySQL database directly to exploit it. Attackers should never, ever be able to connect directly to your MySQL database directly . If you can connect to your MySQL instance directly from your Macbook in your living room, fix it right now .