MySQL contains a flaw that may allow a malicious user to authenticate with the database without a password. The issue is triggered when a 4.1 protocol request occurs with a zero length password. It is possible that the flaw may allow arbitrary SQL command execution resulting in a loss of confidentiality and integrity.

Upgrade to version 4.1.3 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround(s): rename the 'root' account and apply host based login restrictions.

Note that the 4.0 series of the MySQL server is not affected and does not require an upgrade.

• Secunia Advisory ID: 12020
• CERT VU: 184030
• CVE ID: 2004-0627 (see also: NVD)
• Milw0rm: 311
• Exploit Database: 311
• Related OSVDB ID: 7476
• Mail List Post: http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0001.html
  http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0003.html
• Generic Exploit URL: http://immunitysec.com
  http://www.k-otik.com/exploits/07102004.mysql5_auth_bypass_zeropass.pl.php
• Vendor URL: http://www.mysql.com
• Other Advisory URL: http://www.nextgenss.com/advisories/mysql-authbypass.txt
• Generic Informational URL: http://www.ngssoftware.com/papers/HackproofingMySQL.pdf

• Chris Anley - NGS Software