ID de Prueba:	1.3.6.1.4.1.25623.1.0.802046
Categoría:	Databases
Título:	MariaDB Authentication Error Message User Enumeration Vulnerability
Resumen:	MariaDB is prone to a user enumeration vulnerability.
Descripción:	Summary: MariaDB is prone to a user enumeration vulnerability. Vulnerability Insight: A MariaDB server will respond with a different message than Access Denied, when an attacker authenticates using an incorrect password with the old authentication mechanism from MySQL 4.x and below (as used in MariaDB) to a MariaDB 5.x server. Vulnerability Impact: Successful exploitation allows an attacker to obtain valid usernames, which may aid them in brute-force password cracking or other attacks. Affected Software/OS: MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66 and possibly other versions. Solution: Update MariaDB to version 5.5.29, 5.3.12, 5.2.14 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2012-5615 20121201 MySQL Remote Preauth User Enumeration Zeroday http://seclists.org/fulldisclosure/2012/Dec/9 53372 http://secunia.com/advisories/53372 GLSA-201308-06 http://security.gentoo.org/glsa/glsa-201308-06.xml MDVSA-2013:102 http://www.mandriva.com/security/advisories?name=MDVSA-2013:102 SUSE-SU-2013:0262 http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html SUSE-SU-2015:0743 http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html [oss-security] 20121202 Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday http://www.openwall.com/lists/oss-security/2012/12/02/3 http://www.openwall.com/lists/oss-security/2012/12/02/4 http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html https://mariadb.atlassian.net/browse/MDEV-3909
Copyright	Copyright (C) 2012 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.