A Tragically Comedic Security Flaw in MySQL

nosql:

In short, if you try to authenticate to a MySQL server affected by this flaw, there is a chance it will accept your password even if the wrong one was supplied. The following one-liner in bash will provide access to an affected MySQL server as the root user account, without actually knowing the password.

 $ for i in `seq 1 1000`; do mysql -u root --password=bad -h 127.0.0.1 2>/dev/null; done

Don’t try this at home. Or if you try it, don’t tell anyone the result.

Original title and link: A Tragically Comedic Security Flaw in MySQL (NoSQL database©myNoSQL)

21 Notes/ Hide

  1. vgarrido ha rebloggato questo post da nosql
  2. dursunkoc ha rebloggato questo post da nosql
  3. kobebigs ha rebloggato questo post da nosql
  4. breathingfeelsnice ha rebloggato questo post da nosql e ha aggiunto:
    que MySql que que?? jajaja
  5. emanuele88 ha rebloggato questo post da nosql
  6. blackibiza ha rebloggato questo post da nosql
  7. rshogus ha rebloggato questo post da nosql
  8. janos-p-toth ha rebloggato questo post da nosql
  9. postato da nosql