3 ms·
Whether a particular build of MySQL or MariaDB is vulnerable, depends on how and where it was built. A prerequisite is a memcmp() that can return an arbitrary i
by ushi 14y ago
Whether a particular build of MySQL or MariaDB is vulnerable, depends on
how and where it was built. A prerequisite is a memcmp() that can return
an arbitrary integer (outside of -128..127 range). To my knowledge gcc
builtin memcmp is safe, BSD libc memcmp is safe. Linux glibc
sse-optimized memcmp is not safe, but gcc usually uses the inlined
builtin version.
How do you know, how the Ubuntu devs compiled their mysql server?
- dangrossman 14y agoTry to connect to MySQL as root with a made-up password several hundred times. If you successfully connect, the bug is present and you know how it was compiled.
- gringomorcego 14y agowhere is the perl one-liner :P?
- mcpherrinm 14y agoperl -e 'use DBI; for($i=0;$i<4096;$i++){DBI->connect("dbi:mysql:", "root", "nope", {PrintError=>0}) and die "Vulnerable!";}'
- deleted 14y ago[deleted]
- ushi 14y agoHehe, ok ok.
- mjschultz 14y agoWell, the Ubuntu part came from HD Moore [1]. I haven't been able to confirm it on my Ubuntu 12.04 virtual machine instance though, nor does my virtual machine appear to trigger the bug using the CVE-2012-2122 checker [2]. But, that is just my single VM instance and I would assume HD Moore knows what he is doing. [1] http://pastie.org/private/903voijkkz8nmde3yqj4rw http://pastie.org/private/903voijkkz8nmde3yqj4rw [2] http://pastie.org/4064638 http://pastie.org/4064638
- zzzzzzzzz 14y agoI can confirm. Ubuntu 12.04 LTS (64 bit).
- Alan01252 14y agoThe C script is returning vulnerable on both my local machine (precise) and my vps (Ubuntu 11.10). However tests of trying to brute force the root password using the mysql one liners in this thread have failed every time. Both machines allow local access only so I assume I'm safe.
- michiel3 14y agoYep, if you're blocking remote hosts to authenticate on 3306 (or any other port you're running mysqld on) you're safe. The attacking host can't authenticate itself, so it's unable to exploit this bug.