Test Kennung:	1.3.6.1.4.1.25623.1.0.802046
Kategorie:	Databases
Titel:	MariaDB Authentication Error Message User Enumeration Vulnerability
Zusammenfassung:	MariaDB is prone to a user enumeration vulnerability.
Beschreibung:	Summary: MariaDB is prone to a user enumeration vulnerability. Vulnerability Insight: A MariaDB server will respond with a different message than Access Denied, when an attacker authenticates using an incorrect password with the old authentication mechanism from MySQL 4.x and below (as used in MariaDB) to a MariaDB 5.x server. Vulnerability Impact: Successful exploitation allows an attacker to obtain valid usernames, which may aid them in brute-force password cracking or other attacks. Affected Software/OS: MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66 and possibly other versions. Solution: Update MariaDB to version 5.5.29, 5.3.12, 5.2.14 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2012-5615 20121201 MySQL Remote Preauth User Enumeration Zeroday http://seclists.org/fulldisclosure/2012/Dec/9 53372 http://secunia.com/advisories/53372 GLSA-201308-06 http://security.gentoo.org/glsa/glsa-201308-06.xml MDVSA-2013:102 http://www.mandriva.com/security/advisories?name=MDVSA-2013:102 SUSE-SU-2013:0262 http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html SUSE-SU-2015:0743 http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html [oss-security] 20121202 Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday http://www.openwall.com/lists/oss-security/2012/12/02/3 http://www.openwall.com/lists/oss-security/2012/12/02/4 http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html https://mariadb.atlassian.net/browse/MDEV-3909
Copyright	Copyright (C) 2012 Greenbone AG

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.