National Vulnerability Database (CVE-2002-1374)

National Cyber-Alert System Vulnerability Summary: CVE-2002-1374
Orirignal release date: 2002-12-23 Source: US-CERT/NIST ### Overview The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password. ### Impact CVSS Severity: 7 (High) Range: remote Authentication: design Impact Type: sec_prot user="1" ### Reference to Advisories, Solutions, and Tools External Source: Bugtraq Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: Linux Security Name: Several MySQL vulnerabilities. Hyperlink: http://www.linuxsecurity.com/advisories/engarde_advisory-2660.html External Source: Security Focus Name: MySQL COM_CHANGE_USER Password Length Account Compromise Vulnerability Hyperlink: http://www.securityfocus.com/bid/6373 External Source: ISS X-Force Name: MySQL COM_CHANGE_USER command password authentication bypass Hyperlink: http://xforce.iss.net/xforce/xfdb/10847 External Source: MISC Name: http://security.e-matters.de/advisories/042002.html Hyperlink: http://security.e-matters.de/advisories/042002.html ### Vulnerable Software and Vendor MySQL (MySQL) NetBackup Global Data Manager (Symantec Veritas) NetBackup Advanced Reporter (Symantec Veritas) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1374