MariaDB contains a flaw that is triggered when a users connects to MariaDB and a randomly generated token is calculated and then compared with an expected value. Due to a failure in casting it is possible that the values are seen as equal even if the memcmp() function returns a zero value. This will tell the program that the password is correct, when it is not. Due to the protocol generating random strings this may allow an attacker to bypass password authentication with a 1/256 chance of success.
Classification
Location:
Local / Remote
Attack Type:
Authentication Management
Impact:
Loss of Integrity
Solution:
Upgrade
Exploit:
Exploit Public
Disclosure:
Vendor Verified
Solution
Upgrade to version 5.1.62, 5.2.12, 5.3.6, 5.5.23 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
