An interesting vulnerability has been discovered in MySQL and MariaDB.
Essentially it means that under certain conditions it is possible to provide any password and MySQL it will accept it.
This flaw is a programming error and its because of an incorrect casting. This can result in incorrectly calculating the password that the login attempt provides is the same as the one that is for authenticating against.
This only happens 1 in 256 due to the random string that MySQL uses in the authentication procedure. All encryption is vulnerable to a poor quality random number generator. Which whilst not the cause of this problem is related to the fact that it’s possible so frequently. Whilst 1 in 256 might sound like a large number of authentication attempts. In computer terms, the completion of this task can take approximately a couple of seconds.
Learn how YGHT can help you increase your cybersecurity